DSA-4496: -1 pango1.0 -- security update
Benno Fuenfstueck discovered that Pango, a library for layout and rendering of text with an emphasis on internationalization, is prone to a heap-based buffer overflow flaw in the pangolog2visgetembeddinglevels function. An attacker can take advantage of this flaw for denial of service or potentially the execution of arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pango1.0to a version that resolves this vulnerability.Patch DSA-4496-1
Event History
Frequently Asked Questions
What impact could successful exploitation have?
The flaw can be used to cause a denial of service and may potentially allow execution of arbitrary code.
Which component contains the vulnerable function?
The issue is in Pango's pango_log2vis_get_embedding_levels function. The affected software entry is debian/pango1.0.
What type of vulnerability is this?
This is a heap-based buffer overflow, classified as CWE Buffer Overflow.