CVE-2017-11576

MEDIUM

FontForge 20161012 - Denial of Service via Crafted OTF File

Title source: llm

Description

FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.

References (2)

Core 2

Core References

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2017/dsa-3958

Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://github.com/fontforge/fontforge/issues/3091

Scores

CVSS v3 5.5

EPSS 0.0071

EPSS Percentile 48.9%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-119

Status published

Products (1)

fontforge/fontforge 20161012

Published Jul 23, 2017

Tracked Since Feb 18, 2026