CVE-2014-2570 Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-font-lib(Debian:12) | < 0.3.1+dfsg-2 | 0.3.1+dfsg-2 |
| debian/php-font-lib(Debian:13) | < 0.3.1+dfsg-2 | 0.3.1+dfsg-2 |
| debian/php-font-lib(Debian:14) | < 0.3.1+dfsg-2 | 0.3.1+dfsg-2 |
| php font lib project php font lib | <= 0.3 | No fix listed |
| ubuntu/php-font-lib(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/php-font-lib(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/php-font-lib(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/php-font-lib(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2014-2570 vendor-advisory
- codalabs.net exploit
- 104896 vdb-entry
- 20140324 CVE-2014-2570 - php-font-lib 0.3 www/make_subset.php Reflected Cross Site Scripting mailing-list
- 66380 exploit vdb-entry
- github.com
- github.com patch