CVE-2023-45139 fonttools XML External Entity Injection (XXE) Vulnerability
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-45139?
CVE-2023-45139 is a high-severity vulnerability in fonttools, published on 10 Jan 2024.
Official description
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.
Weakness: CWE-611
Which versions are affected by CVE-2023-45139?
3 open source packages ship an affected version, including fonttools. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fonttools PyPI | From 4.28.2 | 4.43.0 |
fonttools PyPI | From 4.28.2 | 4.43.0 |
fonttools PyPI | From 4.28.2 | 4.43.0 |
Linux distribution packages (1)
python-FontTools openSUSE:Tumbleweed | All versions | 4.62.1-1.3 |
Products include Fonttools Fonttools.
How do I fix CVE-2023-45139?
Upgrade fonttools to 4.43.0 or later.
Is CVE-2023-45139 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45139 exists.
Other vulnerabilities in fonttools
Sources
Also known as DEBIAN-CVE-2023-45139, GHSA-6673-4983-2vx5, MGASA-2024-0060, OESA-2024-1080, PYSEC-2026-1388, UBUNTU-CVE-2023-45139 and 2 more.