CVE-2011-0064: Null Pointer Dereference
It was discovered that pango did not check for memory reallocation failures in hbbufferensure() function. This could trigger a NULL pointer dereference in hbbufferaddglyph(), where possibly untrusted input is used as an index used for accessing members of the incorrectly reallocated array, resulting in the use of NULL address as the base array address. This can result in application crash or, possibly, code execution.
It was demonstrated that it's possible to trigger this flaw in Firefox via a specially crafted web page.
Mozilla bug report (currently not public): https://bugzilla.mozilla.org/showbug.cgi?id=606997
Fix in the harfbuzz git: http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e
Acknowledgements:
Red Hat would like to thank Mozilla Security Team for reporting this issue.
Other sources
The hbbufferensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0064?
CVE-2011-0064 is classified as a moderate severity vulnerability due to the potential for a NULL pointer dereference.
How do I fix CVE-2011-0064?
To fix CVE-2011-0064, update your Pango library to a version that contains the patch addressing memory reallocation failure.
Which software is affected by CVE-2011-0064?
CVE-2011-0064 affects versions of Mozilla Firefox and Pango version 1.28.3.
What causes the vulnerability identified as CVE-2011-0064?
The CVE-2011-0064 vulnerability is caused by the lack of memory reallocation failure checks in the hb_buffer_ensure() function.
Can untrusted input trigger the vulnerability in CVE-2011-0064?
Yes, CVE-2011-0064 can be triggered by possibly untrusted input being used as an index in a dereferenced array.