CVE-2024-25081 Command injection in n/a
Attackers can execute arbitrary commands via crafted filenames in FontForge, requiring users to update the library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-25081?
CVE-2024-25081 is a medium-severity command injection vulnerability in Debian Debian Linux, published on 26 Feb 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
Weakness: CWE-77
Which versions are affected by CVE-2024-25081?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Fontforge Fontforge.
How do I fix CVE-2024-25081?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-25081 being exploited?
There is no known exploitation of CVE-2024-25081 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2024-25081, GHSA-rjx3-xwwm-jhj5, UBUNTU-CVE-2024-25081, openSUSE-SU-2024:13755-1.