CVE-2010-0421: Buffer Overflow
Array index error in the hbotlayoutbuildglyphclasses function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.
Other sources
Marc Schoenefeld found an improper input sanitization, leading to array indexing error, in the way Pango font rendering library synthesized Glyph Definition Table (GDEF) from the font's character map and the Unicode property database. If a local user was tricked into loading a specially-crafted font file in an application, using the Pango font rendering library, it could lead to denial of service (relevant application crash).
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0421?
CVE-2010-0421 has been classified as having a moderate severity level due to its potential to cause application crashes.
How do I fix CVE-2010-0421?
To address CVE-2010-0421, upgrade Pango to version 1.27.1 or later where the vulnerability is patched.
What kind of attacks can exploit CVE-2010-0421?
CVE-2010-0421 can be exploited by attackers using crafted font files to trigger a denial of service attack.
What versions of Pango are affected by CVE-2010-0421?
Pango versions prior to 1.27.1 are affected by CVE-2010-0421.
Can CVE-2010-0421 lead to data exposure?
CVE-2010-0421 primarily causes denial of service, and does not directly lead to data exposure.