Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fonttools XML External Entity Injection (XXE) Vulnerability
Vulnerability Description
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
fontTools 代码问题漏洞
Vulnerability Description
fontTools是一个用 Python 编写的用于操作字体的库。 fontTools 4.43.0之前版本存在代码问题漏洞。攻击者利用该漏洞可以运行 fontTools 的文件系统的任意文件。
CVSS Information
N/A
Vulnerability Type
N/A