CVE-2017-11576

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3958
https://github.com/fontforge/fontforge/issues/3091Issue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3958
https://github.com/fontforge/fontforge/issues/3091Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jul 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-115777.8FontForge 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c) resulting in DoS or code execution via a crafted otf file.CVE-2017-115785.9It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect CVE-2017-115797.1In the most recent firmware for Blipcare, the device provides an open Wireless network called "Blip" for communicating with the device. The CVE-2017-115806.5Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Bl CVE-2017-115816.1dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' ch CVE-2017-115829.8dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.CVE-2017-115839.8dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.CVE-2017-115849.8dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to CVE-2017-115859.8dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval In CVE-2017-115866.1dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.CVE-2017-115877.5On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann CVE-2017-115889.8On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-Ann