CVE-2023-45139

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

• CWE-611

• http://www.openwall.com/lists/oss-security/2024/03/08/2
• http://www.openwall.com/lists/oss-security/2024/03/09/1
• https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4cPatch
• https://github.com/fonttools/fonttools/releases/tag/4.43.0Release Notes
• https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/
• http://www.openwall.com/lists/oss-security/2024/03/08/2
• http://www.openwall.com/lists/oss-security/2024/03/09/1
• https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4cPatch
• https://github.com/fonttools/fonttools/releases/tag/4.43.0Release Notes
• https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/

Published

Jan 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45133Babel is a compiler for writingJavaScript. In `@babel/traver…8.8
• CVE-2023-45134XWiki Platform is a generic wiki platform offering runtime s…9
• CVE-2023-45135XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2023-45136XWiki Platform is a generic wiki platform offering runtime s…9.6
• CVE-2023-45137XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-45138Change Request is an pplication allowing users to request ch…9.6
• CVE-2023-4514The Mmm Simple File List WordPress plugin through 2.3 does n…5.4
• CVE-2023-45140The Bastion provides authentication, authorization, traceabi…4.6
• CVE-2023-45141Fiber is an express inspired web framework written in Go. A …8.8
• CVE-2023-45142OpenTelemetry-Go Contrib is a collection of third-party pack…7.5
• CVE-2023-45143Undici is an HTTP/1.1 client written from scratch for Node.j…3.5
• CVE-2023-45144com.xwiki.identity-oauth:identity-oauth-ui is a package to a…9.6