[Git][security-tracker-team/security-tracker][master] Update status for CVE-2017-17521/fontforge

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
00e3c9ec by Salvatore Bonaccorso at 2026-08-10T07:50:59+02:00
Update status for CVE-2017-17521/fontforge

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -768844,8 +768844,9 @@ CVE-2017-17522 (Lib/webbrowser.py in Python through 3.6.3 does not validate stri
 	NOTE: Hardly an issue with security impact, as the problematic code further relies
 	NOTE: on subprocess.Popen with the default shell=False.
 CVE-2017-17521 (uiutil.c in FontForge through 20170731 does not validate strings befor ...)
-	- fontforge <unfixed> (unimportant)
+	- fontforge 1:20201107~dfsg-1 (unimportant)
 	NOTE: https://sources.debian.org/src/fontforge/1:20170731%7Edfsg-1/fontforgeexe/uiutil.c/#L285
+	NOTE: Code removed in https://github.com/fontforge/fontforge/commit/029bbb606b6502d651454fee996f8dd3ea15fa94 (20200314)
 CVE-2017-17520 (tools/url_handler.pl in TIN 2.4.1 does not validate strings before lau ...)
 	NOTE: Bogus CVE assignment, works as intended:
 	NOTE: https://sources.debian.org/src/tin/1:2.4.1-1/tools/url_handler.pl/?hl=120#L120



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00e3c9ec69a0ab952bbb6ea646269b75425b3c0f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00e3c9ec69a0ab952bbb6ea646269b75425b3c0f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260810/9c4404a2/attachment.htm>