CVE-2011-0020: Buffer Overflow
A heap-based buffer overflow, leading to array index error was found in the way the Pango font rendering library rendered glyph box for certain FTBitmap objects, when the FreeType2 Pango back end was used for rendering. If an attacker created a specially-crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library and FreeType2 Pango back end was used for rendering, it could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
References: [1] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616
CVE Request: [2] http://www.openwall.com/lists/oss-security/2011/01/18/6
Public PoC: [3] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1 (malicious font) [4] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2 (sample text file to trigger the crash)
Other sources
Heap-based buffer overflow in the pangoft2fontrenderboxglyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FTBitmap object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0020?
CVE-2011-0020 is considered a critical vulnerability due to its potential to exploit a heap-based buffer overflow, which can lead to arbitrary code execution.
How do I fix CVE-2011-0020?
To remediate CVE-2011-0020, update the Pango package to version 0:1.14.9-13.el4_10, 0:1.14.9-8.el5_6.2, or 0:1.28.1-3.el6_0.3 depending on your system.
What are the affected versions for CVE-2011-0020?
CVE-2011-0020 affects multiple versions of the Pango library up to and including 1.28.3.
Who is the vendor for the CVE-2011-0020 vulnerability?
The vendor for CVE-2011-0020 is GNOME, responsible for the Pango font rendering library.
Can CVE-2011-0020 be exploited remotely?
CVE-2011-0020 is not typically remote; it requires the user to open a specially-crafted font file, allowing local exploitation.