CVE-2009-1194: Buffer Overflow
Integer overflow in the pangoglyphstringsetsize function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
Other sources
Will Drewry reported an integer overflow flaw in pango's pangoglyphstringsetsize in pango/glyphstring.c:
61 while (newlen > string->space) 62 { 63 if (string->space == 0) 64 string->space = 1; 65 else 66 string->space = 2; 67 68 if (string->space < 0) 69 { 70 gwarning ("glyph string length overflows maximum integer size, truncated"); 71 newlen = string->space = GMAXINT - 8; 72 } 73 } 74 75 string->glyphs = grealloc (string->glyphs, string->space sizeof (PangoGlyphInfo));
string->space is checked against overflow when doubling it, but is not protected against overflow when multiplied by sizeof(PangoGlyphInfo).
Upstream fix: http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e
Acknowledgements:
Red Hat would like to thank Will Drewry for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1194?
The severity of CVE-2009-1194 is considered high as it can lead to denial of service or potentially arbitrary code execution.
How do I fix CVE-2009-1194?
To fix CVE-2009-1194, update to a non-vulnerable version of the Pango library, specifically version 1.24 or later.
What does CVE-2009-1194 exploit?
CVE-2009-1194 exploits an integer overflow in the pango_glyph_string_set_size function that can trigger a heap-based buffer overflow.
Which Pango versions are affected by CVE-2009-1194?
Pango versions prior to 1.24, including 1.2 to 1.22, are affected by CVE-2009-1194.
Is CVE-2009-1194 a remote code execution vulnerability?
CVE-2009-1194 could potentially allow remote code execution, making it critical for users to apply updates.