CVE:CVE-2020-5395
CNNVD:CNNVD-202001-080
FontForge是一款开源的支持多种语言的字体编辑工具。
FontForge 20190801版本中的sfd.c文件的‘SFD_GetFontMetaData’函数存在资源管理错误漏洞。本地攻击者可借助特制文件利用该漏洞导致应用程序崩溃。
solution:Upgrade fontforge fontforge to a higher version than 20190801,and avoid the version 20190801; Upgrade fedoraproject fedora to a higher version than 31,and avoid the version 31; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1