CVE-2017-11576

{"id": "CVE-2017-11576", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2017-07-23T22:29:00.477", "references": [{"url": "http://www.debian.org/security/2017/dsa-3958", "source": "cve@mitre.org"}, {"url": "https://github.com/fontforge/fontforge/issues/3091", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2017/dsa-3958", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/fontforge/fontforge/issues/3091", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file."}, {"lang": "es", "value": "FontForge versi\u00f3n 20161012, no garantiza un tama\u00f1o positivo en una llamada memcpy de vector weight en la funci\u00f3n readcfftopdict (parsettf.c) resultando en una DoS por medio de un archivo otf creado."}], "lastModified": "2024-11-21T03:08:03.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fontforge:fontforge:20161012:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86C3205C-92DF-4B61-9D3F-B35D1230FB8D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}