CVE-2011-0064: Null Pointer Dereference
First published: Fri Feb 18 2011(Updated: )
It was discovered that pango did not check for memory reallocation failures in hb_buffer_ensure() function. This could trigger a NULL pointer dereference in hb_buffer_add_glyph(), where possibly untrusted input is used as an index used for accessing members of the incorrectly reallocated array, resulting in the use of NULL address as the base array address. This can result in application crash or, possibly, code execution. It was demonstrated that it's possible to trigger this flaw in Firefox via a specially crafted web page. Mozilla bug report (currently not public): <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=606997">https://bugzilla.mozilla.org/show_bug.cgi?id=606997</a> Fix in the harfbuzz git: <a href="http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e">http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e</a> Acknowledgements: Red Hat would like to thank Mozilla Security Team for reporting this issue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | ||
| Gnome Pango | =1.28.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=606997
- http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=678563#c1
- http://git.gnome.org/browse/pango/commit/?id=336bb320
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=480386&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=480386&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=678563#c0
- http://cgit.freedesktop.org/harfbuzz/commit/?id=b5dd44e24669
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=678563#c10
- https://build.opensuse.org/request/show/63070
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=681378
- https://rhn.redhat.com/errata/RHSA-2011-0309.html
- https://bugzilla.redhat.com/show_bug.cgi?id=678563
- http://www.debian.org/security/2011/dsa-2178
- http://www.vupen.com/english/advisories/2011/0558
- http://www.securityfocus.com/bid/46632
- https://bugzilla.novell.com/show_bug.cgi?id=672502
- http://www.vupen.com/english/advisories/2011/0555
- http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9
- http://www.ubuntu.com/usn/USN-1082-1
- http://secunia.com/advisories/43559
- http://securitytracker.com/id?1025145
- http://secunia.com/advisories/43572
- http://secunia.com/advisories/43578
- http://www.redhat.com/support/errata/RHSA-2011-0309.html
- http://www.vupen.com/english/advisories/2011/0543
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:040
- http://www.vupen.com/english/advisories/2011/0584
- http://secunia.com/advisories/43800
- http://www.vupen.com/english/advisories/2011/0683
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65770
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/nvd-historical
- vendor/mozilla
- canonical/mozilla firefox
- vendor/gnome
- canonical/gnome pango
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/references
- agent/remedy
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0064
- version/gnome pango/1.28.3