CVE-2023-45139

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45139
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/08/2
http://www.openwall.com/lists/oss-security/2024/03/09/1
https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c Patch
https://github.com/fonttools/fonttools/releases/tag/4.43.0 Release Notes
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/
http://www.openwall.com/lists/oss-security/2024/03/08/2
http://www.openwall.com/lists/oss-security/2024/03/09/1
https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c Patch
https://github.com/fonttools/fonttools/releases/tag/4.43.0 Release Notes
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 Exploit Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/
Configurations

Configuration 1 (hide)

cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*
History

21 Nov 2024, 08:26

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/03/08/2 - () http://www.openwall.com/lists/oss-security/2024/03/08/2 -
References () http://www.openwall.com/lists/oss-security/2024/03/09/1 - () http://www.openwall.com/lists/oss-security/2024/03/09/1 -
References () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - Patch () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - Patch
References () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - Release Notes () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - Release Notes
References () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - Exploit, Vendor Advisory () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - Exploit, Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/ -

01 May 2024, 19:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/08/2 -

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/09/1 -

25 Jan 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/ -

17 Jan 2024, 15:36

Type Values Removed Values Added
References () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - () https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - Exploit, Vendor Advisory
References () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - () https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c - Patch
References () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - () https://github.com/fonttools/fonttools/releases/tag/4.43.0 - Release Notes
First Time Fonttools
Fonttools fonttools
CPE cpe:2.3:a:fonttools:fonttools:*:*:*:*:*:python:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

10 Jan 2024, 16:59

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-10 16:15

Updated : 2024-11-21 08:26

NVD link : CVE-2023-45139

Mitre link : CVE-2023-45139

CVE.ORG link : CVE-2023-45139

JSON object : View

Products Affected

fonttools

  • fonttools
CWE
CWE-611

Improper Restriction of XML External Entity Reference