Issued:
2020-11-03
Updated:
2020-11-03

RHSA-2020:4844 - Security Advisory

Synopsis

Moderate: fontforge security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for fontforge is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

  • fontforge: SFD_GetFontMetaData() insufficient CVE-2020-5395 backport (CVE-2020-25690)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
  • Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
  • Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.4 s390x
  • Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64

Fixes

  • BZ - 1893188 - CVE-2020-25690 fontforge: SFD_GetFontMetaData() insufficient CVE-2020-5395 backport

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
x86_64
fontforge-20170731-15.el8.i686.rpm SHA-256: 97f298b69bcac0760ff10cdd23f2d370f6161f83ebdc88044adfb71659828acf
fontforge-20170731-15.el8.x86_64.rpm SHA-256: 421878c34a43111cb28b9d7eb0d9388b9448de88c9687fee89fe347acb686d54
fontforge-debuginfo-20170731-15.el8.i686.rpm SHA-256: dbc60e3febf487df9e42f1e3a96ce0712241afd3fd3bb8ddbbf88d513698a052
fontforge-debuginfo-20170731-15.el8.x86_64.rpm SHA-256: 9cb91650bd1369142831f4e7a8203346fc411d999c72441656bccdbb7cd80007
fontforge-debugsource-20170731-15.el8.i686.rpm SHA-256: 23defe93a4047854bce62011a4fdb823c13ca6e4e54022e2fdf9ef3a4d01894b
fontforge-debugsource-20170731-15.el8.x86_64.rpm SHA-256: cce8837b591a9ddddc0207517dd100c22aeaa2bbd3a28e8a62fd06c76bb3cd8c

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
ppc64le
fontforge-20170731-15.el8.ppc64le.rpm SHA-256: ccf7af0d7a0a53db4950bf6f948ff68cf12d520a208286c6848b52c2aa0948a6
fontforge-debuginfo-20170731-15.el8.ppc64le.rpm SHA-256: 688266d9f0597d7cccfc87c63fafc17249df5ff2bcdd745bfacdcb2451fb8513
fontforge-debugsource-20170731-15.el8.ppc64le.rpm SHA-256: f9bcaf6d3d1746abd478c1dcc67040ed7a0c55da9b2144631f95f5fbcdc4314d

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
aarch64
fontforge-20170731-15.el8.aarch64.rpm SHA-256: 062b498742ba3336594273650848731347e6f0da8d917cf365eb23a99ba73c05
fontforge-debuginfo-20170731-15.el8.aarch64.rpm SHA-256: 405ab872242e9641a669ba06c6332dca36c7dc68beac2abadf9f1e3e12f9864d
fontforge-debugsource-20170731-15.el8.aarch64.rpm SHA-256: 32b275e93bec4ef9d01d161f4de02d161389fa6eb688d69740086b837ee002ef

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
s390x
fontforge-20170731-15.el8.s390x.rpm SHA-256: 6b43466865cf00460576e6c7c927ae89fbf6c84332dee3360839f83367437c31
fontforge-debuginfo-20170731-15.el8.s390x.rpm SHA-256: e28588d8f044e28ee8356d631c0b9d2826eef3eeff782fbf53c95677bb2dff43
fontforge-debugsource-20170731-15.el8.s390x.rpm SHA-256: 15d425db5b0b6afc7ffd68ba63c4ab85da132c20632d3c6d626c846b0c405827

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
x86_64
fontforge-20170731-15.el8.i686.rpm SHA-256: 97f298b69bcac0760ff10cdd23f2d370f6161f83ebdc88044adfb71659828acf
fontforge-20170731-15.el8.x86_64.rpm SHA-256: 421878c34a43111cb28b9d7eb0d9388b9448de88c9687fee89fe347acb686d54
fontforge-debuginfo-20170731-15.el8.i686.rpm SHA-256: dbc60e3febf487df9e42f1e3a96ce0712241afd3fd3bb8ddbbf88d513698a052
fontforge-debuginfo-20170731-15.el8.x86_64.rpm SHA-256: 9cb91650bd1369142831f4e7a8203346fc411d999c72441656bccdbb7cd80007
fontforge-debugsource-20170731-15.el8.i686.rpm SHA-256: 23defe93a4047854bce62011a4fdb823c13ca6e4e54022e2fdf9ef3a4d01894b
fontforge-debugsource-20170731-15.el8.x86_64.rpm SHA-256: cce8837b591a9ddddc0207517dd100c22aeaa2bbd3a28e8a62fd06c76bb3cd8c

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
ppc64le
fontforge-20170731-15.el8.ppc64le.rpm SHA-256: ccf7af0d7a0a53db4950bf6f948ff68cf12d520a208286c6848b52c2aa0948a6
fontforge-debuginfo-20170731-15.el8.ppc64le.rpm SHA-256: 688266d9f0597d7cccfc87c63fafc17249df5ff2bcdd745bfacdcb2451fb8513
fontforge-debugsource-20170731-15.el8.ppc64le.rpm SHA-256: f9bcaf6d3d1746abd478c1dcc67040ed7a0c55da9b2144631f95f5fbcdc4314d

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.4

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
s390x
fontforge-20170731-15.el8.s390x.rpm SHA-256: 6b43466865cf00460576e6c7c927ae89fbf6c84332dee3360839f83367437c31
fontforge-debuginfo-20170731-15.el8.s390x.rpm SHA-256: e28588d8f044e28ee8356d631c0b9d2826eef3eeff782fbf53c95677bb2dff43
fontforge-debugsource-20170731-15.el8.s390x.rpm SHA-256: 15d425db5b0b6afc7ffd68ba63c4ab85da132c20632d3c6d626c846b0c405827

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4

SRPM
fontforge-20170731-15.el8.src.rpm SHA-256: cf1f1a7f821f43a33d91acdff0586fa2baba6c434c9b39ace1ea9a1ad034e7d0
aarch64
fontforge-20170731-15.el8.aarch64.rpm SHA-256: 062b498742ba3336594273650848731347e6f0da8d917cf365eb23a99ba73c05
fontforge-debuginfo-20170731-15.el8.aarch64.rpm SHA-256: 405ab872242e9641a669ba06c6332dca36c7dc68beac2abadf9f1e3e12f9864d
fontforge-debugsource-20170731-15.el8.aarch64.rpm SHA-256: 32b275e93bec4ef9d01d161f4de02d161389fa6eb688d69740086b837ee002ef

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.