Vulnerability Name:

CVE-2020-5395 (CCN-173907)

Assigned:2020-01-03
Published:2020-01-03
Updated:2023-01-24
Summary:FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
8.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
5.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
8.0 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2020-5395

Source: cve@mitre.org
Type: Third Party Advisory
cve@mitre.org

Source: XF
Type: UNKNOWN
fontforge-cve20205395-dos(173907)

Source: CCN
Type: FontForge GIT Repository
Use-after-free (heap) in the SFD_GetFontMetaData() function #4084

Source: cve@mitre.org
Type: Exploit, Patch, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Mailing List, Third Party Advisory
cve@mitre.org

Source: cve@mitre.org
Type: Third Party Advisory
cve@mitre.org

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*
    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*
    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:fontforge:fontforge:20190801:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20205395
    V
    		CVE-2020-5395
    2023-06-22
    oval:org.opensuse.security:def:7886
    P
    		fontforge-20200314-3.3.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3649
    P
    		Security update for u-boot (Important) (in QA)
    2022-08-04
    oval:org.opensuse.security:def:2999
    P
    		ImageMagick-config-6-SUSE-6.8.8.1-71.126.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3269
    P
    		libtirpc-netconfig-1.0.1-17.13.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3637
    P
    		libnetpbm11-10.66.3-8.7.2 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3196
    P
    		libjpeg62-32bit-62.2.0-31.14.2 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3194
    P
    		libjbig2-2.0-12.13 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3834
    P
    		yast2-core-3.3.1-1.7 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:1183
    P
    		Security update for python39 (Important)
    2022-06-24
    oval:org.opensuse.security:def:2944
    P
    		gssproxy-0.8.2-3.9.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2918
    P
    		fetchmail-6.4.22-20.26.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2983
    P
    		libXp-devel-1.0.3-1.24 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94899
    P
    		fontforge-20200314-3.3.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2950
    P
    		hplip-devel-3.21.10-150400.1.9 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2908
    P
    		dirmngr-2.2.27-1.2 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2930
    P
    		ghostscript-9.52-161.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2989
    P
    		libXvMC-devel-1.0.10-1.23 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2997
    P
    		libbsd-devel-0.8.7-3.3.17 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2912
    P
    		e2fsprogs-1.46.4-150400.1.80 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2959
    P
    		kdump-1.0.2+git10.g26f0b96-150400.1.4 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:1654
    P
    		Security update for 389-ds (Important)
    2022-04-04
    oval:org.opensuse.security:def:100723
    P
    		 (Important)
    2022-03-30
    oval:org.opensuse.security:def:1539
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:112243
    P
    		fontforge-20201107-1.6 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:69093
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:64603
    P
    		Security update for dnsmasq (Moderate)
    2021-10-27
    oval:org.opensuse.security:def:69941
    P
    		Security update for containerd, docker, runc (Important)
    2021-10-25
    oval:org.opensuse.security:def:105771
    P
    		fontforge-20201107-1.6 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:96693
    P
    		libsnmp30-5.7.3-8.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:64763
    P
    		Security update for openssl-1_1 (Low)
    2021-09-07
    oval:org.opensuse.security:def:63451
    P
    		python2-Werkzeug-0.14.1-6.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:72446
    P
    		ImageMagick-7.0.7.34-10.15.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72462
    P
    		fontforge-20200314-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101149
    P
    		fontforge-20200314-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62743
    P
    		fontforge-20200314-3.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:65656
    P
    		Security update for git (Moderate)
    2021-07-29
    oval:org.opensuse.security:def:64705
    P
    		Security update for umoci (Important)
    2021-07-27
    oval:org.opensuse.security:def:74720
    P
    		Security update for the Linux Kernel (Important)
    2021-07-15
    oval:org.opensuse.security:def:49444
    P
    		Security update for nodejs12 (Important)
    2021-07-14
    oval:org.opensuse.security:def:64496
    P
    		Security update for openvpn (Moderate)
    2021-05-12
    oval:org.opensuse.security:def:68793
    P
    		Security update for the Linux Kernel (Important)
    2021-05-12
    oval:org.opensuse.security:def:64495
    P
    		Security update for the Linux Kernel (Important)
    2021-05-12
    oval:org.opensuse.security:def:94010
    P
    		 (Important)
    2021-03-24
    oval:org.opensuse.security:def:52020
    P
    		Security update for openssl-1_0_0 (Moderate)
    2021-03-08
    oval:org.opensuse.security:def:25971
    P
    		Security update for fontforge (Moderate)
    2020-12-04
    oval:org.opensuse.security:def:4958
    P
    		Security update for fontforge (Moderate)
    2020-12-04
    oval:org.opensuse.security:def:62980
    P
    		perl-solv-0.7.14-1.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62952
    P
    		glibc-devel-32bit-2.26-8.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:66690
    P
    		Security update for xen (Important)
    2020-12-03
    oval:org.opensuse.security:def:107389
    P
    		fontforge-20200314-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72347
    P
    		fontforge-20200314-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63158
    P
    		libecpg6-10.3-2.8 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62955
    P
    		guile-2.0.14-5.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72133
    P
    		gnome-shell-3.26.2+20180130.0d9c74212-2.43 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3846
    P
    		PackageKit-devel-1.1.3-24.9.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62628
    P
    		fontforge-20200314-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:65549
    P
    		Security update for rpmlint (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72330
    P
    		ImageMagick-7.0.7.34-8.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62948
    P
    		dpkg-1.19.0.4-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72249
    P
    		hplip-3.18.6-5.7.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:116947
    P
    		fontforge-20200314-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49426
    P
    		Security update for python3 (Important)
    2020-12-02
    oval:org.opensuse.security:def:18295
    P
    		Security update for gstreamer-plugins-base (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50505
    P
    		Security update for bluez (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18623
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73263
    P
    		mozilla-nspr-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70046
    P
    		fontforge on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18030
    P
    		Security update for pam (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64030
    P
    		Security update for libxslt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:52082
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18726
    P
    		Security update for ocaml (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18157
    P
    		Security update for liblouis (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50575
    P
    		Security update for libvpx (Important)
    2020-12-01
    oval:org.opensuse.security:def:66598
    P
    		postgresql10 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18423
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:50177
    P
    		argyllcms on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74817
    P
    		Security update for gstreamer-rtsp-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18473
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64875
    P
    		Security update for openssl-1_1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63654
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50640
    P
    		Security update for polkit (Important)
    2020-12-01
    oval:org.opensuse.security:def:52217
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18038
    P
    		Security update for X Window System client libraries (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:19152
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:18252
    P
    		Security update for gimp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18281
    P
    		Security update for php7 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:52279
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49922
    P
    		python2-numpy on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73381
    P
    		fontforge on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18381
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18656
    P
    		Security update for ncurses (Important)
    2020-12-01
    oval:org.opensuse.security:def:64359
    P
    		libopenjp2-7 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:68896
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18514
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18214
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:74950
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49571
    P
    		libplist++-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:65459
    P
    		Security update for SDL2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18260
    P
    		Security update for gstreamer-plugins-base (Low)
    2020-12-01
    oval:org.opensuse.security:def:50415
    P
    		Security update for libu2f-host, pam_u2f (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:19388
    P
    		Security update for spice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18511
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:50744
    P
    		Security update for libxml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63801
    P
    		Security update for libpcap (Important)
    2020-12-01
    oval:org.opensuse.security:def:50671
    P
    		Security update for jasper (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:19178
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18480
    P
    		Security update for php7 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:68990
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:18072
    P
    		Security update for gstreamer-plugins-bad (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49570
    P
    		libpcre2-posix2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18391
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50020
    P
    		libxmltooling-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18750
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:49624
    P
    		fontforge on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18439
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18492
    P
    		Security update for gdk-pixbuf (Low)
    2020-12-01
    oval:org.opensuse.security:def:49425
    P
    		libXrandr2-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50941
    P
    		Security update for python-rtslib-fb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:65746
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18245
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:50868
    P
    		Security update for ceph (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:19414
    P
    		Security update for fontforge (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49776
    P
    		cargo on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18714
    P
    		Security update for graphite2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:110344
    P
    		Security update for fontforge (Moderate)
    2020-11-29
    oval:org.opensuse.security:def:104767
    P
    		Security update for fontforge (Moderate)
    2020-11-26
    oval:org.opensuse.security:def:98077
    P
    		Security update for fontforge (Moderate)
    2020-11-26
    oval:org.opensuse.security:def:75473
    P
    		Security update for fontforge (Moderate)
    2020-11-26
    oval:org.opensuse.security:def:91112
    P
    		Security update for fontforge (Moderate)
    2020-11-26
    oval:com.redhat.rhsa:def:20203966
    P
    		RHSA-2020:3966: fontforge security update (Moderate)
    2020-09-29
    oval:com.redhat.rhsa:def:20201921
    P
    		RHSA-2020:1921: fontforge security update (Moderate)
    2020-04-28
    oval:org.opensuse.security:def:126135
    P
    		Security update for fontforge (Moderate)
    2020-02-18
    oval:org.opensuse.security:def:110612
    P
    		Security update for fontforge (Moderate)
    2020-01-21
    oval:org.opensuse.security:def:90915
    P
    		Security update for fontforge (Moderate)
    2020-01-16
    oval:org.opensuse.security:def:104570
    P
    		Security update for fontforge (Moderate)
    2020-01-16
    oval:org.opensuse.security:def:97880
    P
    		Security update for fontforge (Moderate)
    2020-01-16
    oval:org.opensuse.security:def:75276
    P
    		Security update for fontforge (Moderate)
    2020-01-16
    oval:com.ubuntu.disco:def:202053950000000
    V
    		CVE-2020-5395 on Ubuntu 19.04 (disco) - medium.
    2020-01-03
    oval:com.ubuntu.bionic:def:202053950000000
    V
    		CVE-2020-5395 on Ubuntu 18.04 LTS (bionic) - medium.
    2020-01-03
    oval:com.ubuntu.xenial:def:202053950000000
    V
    		CVE-2020-5395 on Ubuntu 16.04 LTS (xenial) - medium.
    2020-01-03
    BACK
    fontforge_project fontforge 20190801