安全公告详情

NS-SA-2025-0156

2025-07-25 16:49:52

简介

moderate: fonttools security update

严重级别

moderate

主题

An update for fonttools is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of moderate. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

fonttools:


Security Fix(es):
fonttools: A flaw was found in the subsetting module of FontTools, which contains an XML External Entity Injection (XXE) vulnerability. This flaw allows malicious actors to exploit the parsing of candidate fonts, particularly those with an OT-SVG format that includes an SVG table. Through this vulnerability, attackers can manipulate the system to resolve arbitrary entities, potentially allowing them to include files from the filesystem where FontTools is operating or even initiate web requests from the host system.(CVE-2023-45139)
fonttools: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.03B8.

影响组件

  • fonttools

影响产品

  • CGSL MAIN 7.02

更新包

{"fix":[{"product":"CGSL MAIN 7.02","pkgs":[{"binary":["fonttools-4.47.0-2.zncgsl7.2.x86_64.rpm","fonttools-doc-4.47.0-2.zncgsl7.2.noarch.rpm","python3-fonttools+graphite-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+interpolatable-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+lxml-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+plot-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+symfont-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+type1-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+ufo-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+unicode-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools+woff-4.47.0-2.zncgsl7.2.x86_64.rpm","python3-fonttools-4.47.0-2.zncgsl7.2.x86_64.rpm"],"source":"fonttools-4.47.0-2.zncgsl7.2.src.rpm"}]}]}

CVE

参考