REDHAT-BUG-678563: Null Pointer Dereference
It was discovered that pango did not check for memory reallocation failures in hbbufferensure() function. This could trigger a NULL pointer dereference in hbbufferaddglyph(), where possibly untrusted input is used as an index used for accessing members of the incorrectly reallocated array, resulting in the use of NULL address as the base array address. This can result in application crash or, possibly, code execution.
It was demonstrated that it's possible to trigger this flaw in Firefox via a specially crafted web page.
Mozilla bug report (currently not public): https://bugzilla.mozilla.org/showbug.cgi?id=606997
Fix in the harfbuzz git: http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e
Acknowledgements:
Red Hat would like to thank Mozilla Security Team for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-678563?
The severity of REDHAT-BUG-678563 is considered high due to the potential for a NULL pointer dereference that may lead to application crashes.
How do I fix REDHAT-BUG-678563?
To fix REDHAT-BUG-678563, update to the latest version of Pango or apply the relevant patches provided by the maintainers.
What systems are affected by REDHAT-BUG-678563?
REDHAT-BUG-678563 affects systems running Mozilla Firefox and Freedesktop HarfBuzz that utilize the vulnerable Pango library.
What are the risks associated with REDHAT-BUG-678563?
The risks associated with REDHAT-BUG-678563 include potential crashes of applications using the affected library and possible exploitation through untrusted input.
Is there a workaround for REDHAT-BUG-678563?
Currently, there are no official workarounds for REDHAT-BUG-678563; the best practice is to apply updates to mitigate the vulnerability.