REDHAT-BUG-496887: Integer Overflow
First published: Tue Apr 21 2009(Updated: )
Will Drewry reported an integer overflow flaw in pango's pango_glyph_string_set_size in pango/glyphstring.c: 61 while (new_len > string->space) 62 { 63 if (string->space == 0) 64 string->space = 1; 65 else 66 string->space *= 2; 67 68 if (string->space < 0) 69 { 70 g_warning ("glyph string length overflows maximum integer size, truncated"); 71 new_len = string->space = G_MAXINT - 8; 72 } 73 } 74 75 string->glyphs = g_realloc (string->glyphs, string->space * sizeof (PangoGlyphInfo)); string->space is checked against overflow when doubling it, but is not protected against overflow when multiplied by sizeof(PangoGlyphInfo). Upstream fix: <a href="http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e">http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e</a> Acknowledgements: Red Hat would like to thank Will Drewry for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pango |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e
- https://bugzilla.mozilla.org/show_bug.cgi?id=480134
- https://rhn.redhat.com/errata/RHSA-2009-0476.html
- https://access.redhat.com/security/cve/CVE-2009-1194
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1194
- http://www.openwall.com/lists/oss-security/2009/05/07/1
- http://www.ocert.org/advisories/ocert-2009-001.html
- https://launchpad.net/bugs/cve/2009-1194
- http://www.ubuntu.com/usn/USN-773-1
- https://bugzilla.redhat.com/show_bug.cgi?id=496887
Frequently Asked Questions
What is the severity of REDHAT-BUG-496887?
REDHAT-BUG-496887 is classified as a moderate severity vulnerability due to the potential for integer overflow.
How do I fix REDHAT-BUG-496887?
To fix REDHAT-BUG-496887, you should update to the latest version of Pango that includes the patch for this vulnerability.
What systems are affected by REDHAT-BUG-496887?
The vulnerability REDHAT-BUG-496887 affects versions of Pango that are used in various GNOME applications.
Is there a workaround for REDHAT-BUG-496887?
There are no well-documented workarounds for REDHAT-BUG-496887; updating to the patched version is recommended.
When was REDHAT-BUG-496887 reported?
REDHAT-BUG-496887 was reported on April 14, 2009.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-1194
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/pango
- canonical/pango