Security update for fontforge

SUSE Security Update: Security update for fontforge
Announcement ID: SUSE-SU-2019:2236-1
Rating: moderate
References: #1050161 #1050181 #1050185 #1050187 #1050193 #1050194 #1050195 #1050196 #1050200
Cross-References: CVE-2017-11568 CVE-2017-11569 CVE-2017-11571 CVE-2017-11572 CVE-2017-11573 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577
Affected Products:
  • SUSE Linux Enterprise Software Development Kit 12-SP4

An update that fixes 9 vulnerabilities is now available.


This update for fontforge fixes the following security issues:
fontforge was updated to 20170731, fixings lots of bugs and security issues.

  • CVE-2017-11568: Heap-based buffer over-read in PSCharStringToSplines (bsc#1050161)
  • CVE-2017-11569: Heap-based buffer over-read in readttfcopyrights (bsc#1050181)
  • CVE-2017-11571: Stack-based buffer overflow in addnibble (bsc#1050185)
  • CVE-2017-11572: Heap-based buffer over-read in readcfftopdicts (bsc#1050187)
  • CVE-2017-11573: Over-read in ValidatePostScriptFontName (bsc#1050193)
  • CVE-2017-11574: Heap-based buffer overflow in readcffset (bsc#1050194)
  • CVE-2017-11575: Buffer over-read in strnmatch (bsc#1050195)
  • CVE-2017-11576: Ensure a positive size in a weight vector memcpycall in readcfftopdict (bsc#1050196)
  • CVE-2017-11577: Buffer over-read in getsid (bsc#1050200)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Software Development Kit 12-SP4:
    zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-2236=1

Package List:

  • SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le s390x x86_64):
    • fontforge-20170731-11.8.1
    • fontforge-debuginfo-20170731-11.8.1
    • fontforge-debugsource-20170731-11.8.1