This update for fontforge fixes the following issues:
Update to version 20251009.
Security issues fixed:
- CVE-2025-15279: remote code execution via heap-based buffer overflow in BMP file parsing (bsc#1256013).
- CVE-2025-15269: remote code execution via use-after-free in SFD file parsing (bsc#1256032).
- CVE-2025-15275: arbitrary code execution via SFD file parsing buffer overflow (bsc#1256025).
- CVE-2025-50949: memory leak in function DlgCreate8 (bsc#1252652).
Other updates and bugfixes:
-
fix multiple crashes in Multiple Masters.
-
fix crash for content over 32767 characters in GDraw multiline text field.
-
fix crash on Up/Down
-
fix crash in Metrics View.
-
fix UFO crash for empty contours.
-
fix crash issue in allmarkglyphs.
-
Version update to 20251009:
- Update documentation for py scripts (#5180)
- Update GitHub CI runners (#5328)
- Update po files from Croudin sources. (#5330)
- Use consistent Python in MacOS GitHub runner (#5331)
- Fix CI for Windows GitHub runner (#5335)
- Fix lookup flags parsing (#5338)
- Fixes (#5332): glyph file names uXXXXX (#5333)
- make harmonization robust and avoid zero handles after harmonization (#5262)
- Quiet strict prototypes warnings. (#5313)
- Fix crash in parsegvar() due to insufficient buffer (#5339)
- Handle failed iconv conversion. Unhandled execution path was UB, causing a segfault for me (#5329)
- Fix CMake function _get_git_version() (#5342)
- Don't require individual tuple encapsulation in fontforge.font.bitmapSizes setter (#5138)
- nltransform of anchor points (#5345)
- Fix generateFontPostHook being called instead of generateFontPreHook (#5226)
- Always set usDefaultChar to 0 (.notdef) (#5242)
- add font attributes, method to Python docs (#5353)
- fix segfault triggered by Python del c[i:j] (#5352)
- Autoselect internal WOFF2 format (#5346)
- Fix typos in the FAQ (#5355)
- add font.style_set_names attribute to Python API (#5354)
- Bulk tester (#5365)
- Fix...