p PatchFirst

CVE-2023-45139

CVE-2023-45139 · fonttools XML External Entity Injection (XXE) Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

CVSS 7.5 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • fonttools

    Versions
    • >= 4.28.2, < 4.43.0: Affected

    No fix published

  • fonttools Debian:12

    Versions
    • 4.38.0-1
    Affected ranges
    • ECOSYSTEM: < 4.38.0-1+deb12u1

    Update to 4.38.0-1+deb12u1

  • fonttools Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.46.0-1

    Update to 4.46.0-1

  • fonttools Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.46.0-1

    Update to 4.46.0-1

  • fonttools PyPI

    Versions
    • 4.28.2
    • 4.28.3
    • 4.28.4
    • 4.28.5
    • 4.29.0
    • 4.29.1
    • 4.30.0
    • 4.31.0
    • 4.31.1
    • 4.31.2
    • 4.32.0
    • 4.33.0
    • 4.33.1
    • 4.33.2
    • 4.33.3
    • 4.34.0
    • 4.34.1
    • 4.34.2
    • 4.34.3
    • 4.34.4
    • 4.35.0
    • 4.36.0
    • 4.37.0
    • 4.37.1
    • 4.37.2
    • 4.37.3
    • 4.37.4
    • 4.38.0
    • 4.38.1.dev0
    • 4.39.0
    • 4.39.1
    • 4.39.2
    • 4.39.3
    • 4.39.4
    • 4.40.0
    • 4.41.0
    • 4.41.1
    • 4.42.0
    • 4.42.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.28.2, < 4.43.0

    Update to 4.43.0

  • fonttools Ubuntu:Pro:22.04:LTS

    Versions
    • 4.23.1-1
    • 4.27.1-1
    • 4.28.3-1
    • 4.28.5-1
    • 4.29.1-1
    • 4.29.1-2build1
    Affected ranges
    • ECOSYSTEM: < 4.29.1-2ubuntu0.1~esm1

    Update to 4.29.1-2ubuntu0.1~esm1

Original sources

Check your server →