OESA-2024-1080

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1080

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1080.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1080

Upstream

CVE-2023-45139

Published

2024-01-19T11:06:48Z

Modified

2025-08-12T05:22:43.942235Z

Summary

python-fonttools security update

Details

FontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. The project has an MIT open-source licence.

Security Fix(es):

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.(CVE-2023-45139)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:22.03-LTS-SP3 / python-fonttools

Package

Name: python-fonttools
Purl: pkg:rpm/openEuler/python-fonttools&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

fonttools-4.39.4-2.oe2203sp3

Ecosystem specific

{
    "src": [
        "fonttools-4.39.4-2.oe2203sp3.src.rpm"
    ],
    "noarch": [
        "python3-fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
        "fonttools-4.39.4-2.oe2203sp3.noarch.rpm",
        "fonttools-help-4.39.4-2.oe2203sp3.noarch.rpm"
    ]
}