CVE-2011-0064: Null Pointer Dereference
First published: Fri Feb 18 2011(Updated: )
It was discovered that pango did not check for memory reallocation failures in hb_buffer_ensure() function. This could trigger a NULL pointer dereference in hb_buffer_add_glyph(), where possibly untrusted input is used as an index used for accessing members of the incorrectly reallocated array, resulting in the use of NULL address as the base array address. This can result in application crash or, possibly, code execution. It was demonstrated that it's possible to trigger this flaw in Firefox via a specially crafted web page. Mozilla bug report (currently not public): <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=606997">https://bugzilla.mozilla.org/show_bug.cgi?id=606997</a> Fix in the harfbuzz git: <a href="http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e">http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e</a> Acknowledgements: Red Hat would like to thank Mozilla Security Team for reporting this issue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox and Thunderbird | ||
| GNOME Pango | =1.28.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=606997
- http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=678563#c1
- http://git.gnome.org/browse/pango/commit/?id=336bb320
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=480386&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=480386&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=678563#c0
- http://cgit.freedesktop.org/harfbuzz/commit/?id=b5dd44e24669
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=678563#c10
- https://build.opensuse.org/request/show/63070
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=681378
- https://rhn.redhat.com/errata/RHSA-2011-0309.html
- https://bugzilla.redhat.com/show_bug.cgi?id=678563
- http://www.debian.org/security/2011/dsa-2178
- http://www.vupen.com/english/advisories/2011/0558
- http://www.securityfocus.com/bid/46632
- https://bugzilla.novell.com/show_bug.cgi?id=672502
- http://www.vupen.com/english/advisories/2011/0555
- http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9
- http://www.ubuntu.com/usn/USN-1082-1
- http://secunia.com/advisories/43559
- http://securitytracker.com/id?1025145
- http://secunia.com/advisories/43572
- http://secunia.com/advisories/43578
- http://www.redhat.com/support/errata/RHSA-2011-0309.html
- http://www.vupen.com/english/advisories/2011/0543
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:040
- http://www.vupen.com/english/advisories/2011/0584
- http://secunia.com/advisories/43800
- http://www.vupen.com/english/advisories/2011/0683
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65770
Frequently Asked Questions
What is the severity of CVE-2011-0064?
CVE-2011-0064 is classified as a moderate severity vulnerability due to the potential for a NULL pointer dereference.
How do I fix CVE-2011-0064?
To fix CVE-2011-0064, update your Pango library to a version that contains the patch addressing memory reallocation failure.
Which software is affected by CVE-2011-0064?
CVE-2011-0064 affects versions of Mozilla Firefox and Pango version 1.28.3.
What causes the vulnerability identified as CVE-2011-0064?
The CVE-2011-0064 vulnerability is caused by the lack of memory reallocation failure checks in the hb_buffer_ensure() function.
Can untrusted input trigger the vulnerability in CVE-2011-0064?
Yes, CVE-2011-0064 can be triggered by possibly untrusted input being used as an index in a dereferenced array.
- agent/type
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0064
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- vendor/mozilla
- canonical/mozilla firefox
- vendor/gnome
- canonical/gnome pango
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/mozilla firefox and thunderbird
- version/gnome pango/1.28.3