CVE-2011-0020: Buffer Overflow
First published: Tue Jan 18 2011(Updated: )
A heap-based buffer overflow, leading to array index error was found in the way the Pango font rendering library rendered glyph box for certain FT_Bitmap objects, when the FreeType2 Pango back end was used for rendering. If an attacker created a specially-crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library and FreeType2 Pango back end was used for rendering, it could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. References: [1] <a href="https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616">https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616</a> CVE Request: [2] <a href="http://www.openwall.com/lists/oss-security/2011/01/18/6">http://www.openwall.com/lists/oss-security/2011/01/18/6</a> Public PoC: [3] <a href="https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1">https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1</a> (malicious font) [4] <a href="https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2">https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2</a> (sample text file to trigger the crash)
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pango Pango | =1.7 | |
| Pango Pango | =1.5 | |
| Pango Pango | =1.6 | |
| Pango Pango | =1.17 | |
| Pango Pango | =0.23 | |
| Pango Pango | =1.9 | |
| Pango Pango | =1.11 | |
| Pango Pango | =0.22 | |
| Pango Pango | =1.14 | |
| Pango Pango | =1.21 | |
| Pango Pango | =1.27 | |
| Pango Pango | =1.1 | |
| Pango Pango | =1.26 | |
| Pango Pango | =1.16 | |
| Pango Pango | =0.24 | |
| Pango Pango | =1.8 | |
| Pango Pango | =0.25 | |
| Pango Pango | =1.4 | |
| Pango Pango | =1.24 | |
| Pango Pango | =1.19 | |
| Pango Pango | =1.0 | |
| Pango Pango | =1.15 | |
| Pango Pango | =1.25 | |
| Pango Pango | =1.10 | |
| Pango Pango | =1.2 | |
| Pango Pango | =1.3 | |
| Pango Pango | =1.22 | |
| Pango Pango | =1.18 | |
| Pango Pango | =0.21 | |
| Pango Pango | =0.26 | |
| Pango Pango | =0.20 | |
| Pango Pango | =1.12 | |
| Pango Pango | =1.13 | |
| Pango Pango | =1.23 | |
| Pango Pango | =1.20 | |
| Gnome Pango | <=1.28.3 | |
| Gnome Pango | =1.28.2 | |
| Gnome Pango | =1.28.0 | |
| Gnome Pango | =1.28.1 | |
| redhat/evolution28-pango | <0:1.14.9-13.el4_10 | 0:1.14.9-13.el4_10 |
| redhat/pango | <0:1.14.9-8.el5_6.2 | 0:1.14.9-8.el5_6.2 |
| redhat/pango | <0:1.28.1-3.el6_0.3 | 0:1.28.1-3.el6_0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.vupen.com/english/advisories/2011/0186
- https://bugzilla.redhat.com/show_bug.cgi?id=671122
- https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616
- http://openwall.com/lists/oss-security/2011/01/18/6
- http://openwall.com/lists/oss-security/2011/01/20/2
- http://www.securityfocus.com/bid/45842
- http://osvdb.org/70596
- http://www.redhat.com/support/errata/RHSA-2011-0180.html
- http://www.securitytracker.com/id?1024994
- http://secunia.com/advisories/43100
- http://www.vupen.com/english/advisories/2011/0238
- http://secunia.com/advisories/42934
- https://bugzilla.gnome.org/show_bug.cgi?id=639882
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64832
- https://www.cve.org/CVERecord?id=CVE-2011-0020 https://nvd.nist.gov/vuln/detail/CVE-2011-0020
- https://access.redhat.com/errata/RHSA-2011:0180
- https://access.redhat.com/security/cve/CVE-2011-0020
- http://www.openwall.com/lists/oss-security/2011/01/18/6
- https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1
- https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=671123
- https://rhn.redhat.com/errata/RHSA-2011-0180.html
- collector/nvd-historical
- collector/redhat-cve
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0020
- vendor/pango
- canonical/pango pango
- version/pango pango/1.7
- version/pango pango/1.5
- version/pango pango/1.6
- version/pango pango/1.17
- version/pango pango/0.23
- version/pango pango/1.9
- version/pango pango/1.11
- version/pango pango/0.22
- version/pango pango/1.14
- version/pango pango/1.21
- version/pango pango/1.27
- version/pango pango/1.1
- version/pango pango/1.26
- version/pango pango/1.16
- version/pango pango/0.24
- version/pango pango/1.8
- version/pango pango/0.25
- version/pango pango/1.4
- version/pango pango/1.24
- version/pango pango/1.19
- version/pango pango/1.0
- version/pango pango/1.15
- version/pango pango/1.25
- version/pango pango/1.10
- version/pango pango/1.2
- version/pango pango/1.3
- version/pango pango/1.22
- version/pango pango/1.18
- version/pango pango/0.21
- version/pango pango/0.26
- version/pango pango/0.20
- version/pango pango/1.12
- version/pango pango/1.13
- version/pango pango/1.23
- version/pango pango/1.20
- vendor/gnome
- canonical/gnome pango
- version/gnome pango/1.28.3
- version/gnome pango/1.28.2
- version/gnome pango/1.28.0
- version/gnome pango/1.28.1
- package-manager/redhat