CVE-2024-25081

Publication date 26 February 2024

Last updated 30 May 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

4.2 · Medium

Score breakdown

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

Status

Package Ubuntu Release Status
fontforge 24.04 LTS noble
Not affected
23.10 mantic
Fixed 1:20230101~dfsg-1ubuntu0.1
22.04 LTS jammy
Fixed 1:20201107~dfsg-4+deb11u1build0.22.04.1
20.04 LTS focal
Fixed 1:20190801~dfsg-4ubuntu0.1
18.04 LTS bionic
Fixed 1:20170731~dfsg-1ubuntu0.1~esm1
16.04 LTS xenial
Fixed 20120731.b-7.1ubuntu0.1+esm1
14.04 LTS trusty Ignored end of standard support

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

Parameter Value
Base score 4.2 · Medium
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-6856-1
    • FontForge vulnerabilities
    • 27 June 2024

Other references