Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2025-66034

kritisch

CVE-2025-66034

fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file

Veröffentlicht Geändert CWE 91
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.3CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
Red Hat6.3CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (mittel), Red Hat (mittel), Ubuntu (mittel).

Beschreibung

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
chainguardmlflow, open-webui, tensorflow-cpu-jupyter und 1 weitere3.6.0-r1 und 3 weitere
debian 11fonttoolskein Fix angegeben
debian 12fonttools4.38.0-1+deb12u1
debian 13fonttools4.57.0-1+deb13u1
debian 14fonttools4.61.1-1
echofonttools4.38.0-1+deb12u1
pip::GitHub Security Advisory pipfonttools4.60.2
rapidfort debian 12fonttools0:4.57.0-1+deb13u1, 0:4.61.1-1
rapidfort debian 13fonttools0:4.57.0-1+deb13u1, 0:4.61.1-1
rapidfort fedora 43fonttools, python3-fonttools, python3-fonttools+graphite und 9 weitere4.61.0-1.fc43
rapidfort Oracle Linux 10fonttools, python3-fonttools, python3-fonttools+graphite und 9 weitere4.61.0-2.el10_2
rapidfort Oracle Linux 9fonttools, python3-fonttools, python3-fonttools+graphite und 9 weiterekein Fix angegeben
Alle 59 Einträge aus 22 Quellen zeigen
QuellePaketBehoben in
chainguardmlflow3.6.0-r1
chainguardopen-webui0.9.2-r0
chainguardtensorflow-cpu-jupyter2.20.0-r5
chainguardtensorflow-gpu-jupyter2.20.0-r4
debian 11fonttoolskein Fix angegeben
debian 12fonttools4.38.0-1+deb12u1
debian 13fonttools4.57.0-1+deb13u1
debian 14fonttools4.61.1-1
echofonttools4.38.0-1+deb12u1
pip::GitHub Security Advisory pipfonttools4.60.2
rapidfort debian 12fonttools0:4.57.0-1+deb13u1, 0:4.61.1-1
rapidfort debian 13fonttools0:4.57.0-1+deb13u1, 0:4.61.1-1
rapidfort fedora 43fonttools4.61.0-1.fc43
rapidfort fedora 43python3-fonttools4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+graphite4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+interpolatable4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+lxml4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+plot4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+repacker4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+symfont4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+type14.61.0-1.fc43
rapidfort fedora 43python3-fonttools+ufo4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+unicode4.61.0-1.fc43
rapidfort fedora 43python3-fonttools+woff4.61.0-1.fc43
rapidfort Oracle Linux 10fonttools4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+graphite4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+interpolatable4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+lxml4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+plot4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+repacker4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+symfont4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+type14.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+ufo4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+unicode4.61.0-2.el10_2
rapidfort Oracle Linux 10python3-fonttools+woff4.61.0-2.el10_2
rapidfort Oracle Linux 9fonttoolskein Fix angegeben
rapidfort Oracle Linux 9python3-fonttoolskein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+graphitekein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+interpolatablekein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+lxmlkein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+plotkein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+repackerkein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+symfontkein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+type1kein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+ufokein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+unicodekein Fix angegeben
rapidfort Oracle Linux 9python3-fonttools+woffkein Fix angegeben
rapidfort ubuntu 20.04fonttools0:4.55.3-2ubuntu0.25.04.1
rapidfort ubuntu 22.04fonttools0:4.55.3-2ubuntu0.25.04.1
rapidfort ubuntu 24.04fonttools0:4.55.3-2ubuntu0.25.04.1
Red Hatfonttoolskein Fix angegeben
ubuntu 24.04fonttoolskein Fix angegeben
ubuntu 25.04fonttools4.55.3-2ubuntu0.25.04.1
ubuntu 25.10fonttools4.55.3-2ubuntu0.25.10.1
ubuntu 26.04fonttools4.57.0-3ubuntu1
ubuntu 26.10fonttools4.57.0-3ubuntu1
wolfimlflow3.6.0-r1
wolfiopen-webui0.9.2-r0

Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.