[Git][security-tracker-team/security-tracker][master] Add references for fontforge and fonttools issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
fe51d7ed by Salvatore Bonaccorso at 2024-03-14T21:56:24+01:00
Add references for fontforge and fonttools issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5042,11 +5042,13 @@ CVE-2024-25082 (Splinefont in FontForge through 20230101 allows command injectio
 	- fontforge 1:20230101~dfsg-1.1 (bug #1064967)
 	NOTE: https://github.com/fontforge/fontforge/pull/5367
 	NOTE: https://github.com/fontforge/fontforge/commit/216eb14b558df344b206bf82e2bdaf03a1f2f429
+	NOTE: https://www.canva.dev/blog/engineering/fonts-are-still-a-helvetica-of-a-problem/
 CVE-2024-25081 (Splinefont in FontForge through 20230101 allows command injection via  ...)
 	{DLA-3754-1}
 	- fontforge 1:20230101~dfsg-1.1 (bug #1064967)
 	NOTE: https://github.com/fontforge/fontforge/pull/5367
 	NOTE: https://github.com/fontforge/fontforge/commit/216eb14b558df344b206bf82e2bdaf03a1f2f429
+	NOTE: https://www.canva.dev/blog/engineering/fonts-are-still-a-helvetica-of-a-problem/
 CVE-2024-24714 (Unrestricted Upload of File with Dangerous Type vulnerability in bPlug ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-24568 (Suricata is a network Intrusion Detection System, Intrusion Prevention ...)
@@ -14673,6 +14675,7 @@ CVE-2023-45139 (fontTools is a library for manipulating fonts, written in Python
 	[buster] - fonttools <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5
 	NOTE: Fixed by: https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c (4.43.0)
+	NOTE: https://www.canva.dev/blog/engineering/fonts-are-still-a-helvetica-of-a-problem/
 CVE-2023-44250 (An improper privilege management vulnerability [CWE-269] in a Fortinet ...)
 	NOT-FOR-US: FortiGuard
 CVE-2023-41603 (D-Link R15 before v1.08.02 was discovered to contain no firewall restr ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fe51d7ed0af630471e2165d9befb9a02200eecb4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fe51d7ed0af630471e2165d9befb9a02200eecb4
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240314/801ffa07/attachment-0001.htm>