CVE-2023-45139

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45139
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/08/2
http://www.openwall.com/lists/oss-security/2024/03/09/1
https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c Patch
https://github.com/fonttools/fonttools/releases/tag/4.43.0 Release Notes
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/
http://www.openwall.com/lists/oss-security/2024/03/08/2
http://www.openwall.com/lists/oss-security/2024/03/09/1
https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c Patch
https://github.com/fonttools/fonttools/releases/tag/4.43.0 Release Notes
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/
Configurations

Configuration 1 (hide)

cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*
History

21 Nov 2024, 08:26

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/03/08/2 - () http://www.openwall.com/lists/oss-security/2024/03/08/2 -
References () http://www.openwall.com/lists/oss-security/2024/03/09/1 - () http://www.openwall.com/lists/oss-security/2024/03/09/1 -
References () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - Patch () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - Patch
References () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - Release Notes () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - Release Notes
References () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - Exploit, Vendor Advisory () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - Exploit, Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/ -

01 May 2024, 19:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/08/2 -
  • () http://www.openwall.com/lists/oss-security/2024/03/09/1 -

25 Jan 2024, 02:15

Type Values Removed Values Added
Summary
  • (es) fontTools es una librería para manipular fuentes, escrita en Python. El módulo subsetting tiene una vulnerabilidad de inyección de entidades externas XML (XXE) que permite a un atacante resolver entidades arbitrarias cuando se analiza una fuente candidata (fuentes OT-SVG), que contiene una tabla SVG. Esto permite a los atacantes incluir archivos arbitrarios del sistema de archivos en el que se ejecuta fontTools o realizar solicitudes web desde el sistema host. Esta vulnerabilidad ha sido parcheada en la versión 4.43.0.
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/ -
References () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - Patch
References () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - Release Notes
References () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - Exploit, Vendor Advisory
CPE cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*
First Time Fonttools
Fonttools fonttools

10 Jan 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-10 16:15

Updated : 2024-11-21 08:26

NVD link : CVE-2023-45139

Mitre link : CVE-2023-45139

CVE.ORG link : CVE-2023-45139

JSON object : View

Products Affected

fonttools

  • fonttools
CWE
CWE-611

Improper Restriction of XML External Entity Reference