PT-2024-13215 · Fonttools+3 · Fonttools+3

Acornall · Published 2024-01-09 · Updated 2025-12-09 · CVE-2023-45139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions fontTools versions 4.28.2 through 4.42.1

Description The subsetting module in fontTools has a XML External Entity Injection (XXE) vulnerability, allowing an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts) containing a SVG table is parsed. This enables attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system.

Recommendations For fontTools versions 4.28.2 through 4.42.1, update to version 4.43.0 to patch the vulnerability. As a temporary workaround, consider setting the resolve entities=False flag on parsing methods to mitigate the issue. Restrict access to untrusted OT-SVG fonts to minimize the risk of exploitation. Consider disallowing doctype declarations and implementing recursive regex matching as additional mitigation measures.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-45139

GHSA-6673-4983-2VX5

MGASA-2024-0060

OESA-2024-1080

OPENSUSE-SU-2024:13686-1

ROSA-SA-2025-2644

USN-7917-1

Affected Products

Debian

Linuxmint

Ubuntu

Fonttools

References · 35

• 🔥 https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45139.json · Exploit
• https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c · Patch
• https://advisories.mageia.org/MGASA-2024-0060.html · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0060 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45139 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66034 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7917-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45139 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7917-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-45139 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-45139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45139 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45139 · Vendor Advisory