RHSA-2009:0476: Important: pango security update
Pango is a library used for the layout and rendering of internationalizedtext.Will Drewry discovered an integer overflow flaw in Pango'spangoglyphstringsetsize() function. If an attacker is able to pass anarbitrarily long string to Pango, it may be possible to execute arbitrarycode with the permissions of the application calling Pango. (CVE-2009-1194)pango and evolution28-pango users are advised to upgrade to these updatedpackages, which contain a backported patch to resolve this issue. Afterinstalling this update, you must restart your system or restart the Xserver for the update to take effect. Note: Restarting the X server closesall open applications and logs you out of your session.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:0476?
The severity of RHSA-2009:0476 is classified as important.
How do I fix RHSA-2009:0476?
To fix RHSA-2009:0476, update the affected Pango packages to version 1.14.9-5.el5_3 or 1.14.9-11.el4_7 as applicable.
What causes the vulnerability in RHSA-2009:0476?
The vulnerability in RHSA-2009:0476 is caused by an integer overflow flaw in the pango_glyph_string_set_size() function.
Which packages are affected by RHSA-2009:0476?
Affected packages include Pango, Pango-devel, Evolution28-pango, and Evolution28-pango-devel prior to specified versions.
Can exploiting RHSA-2009:0476 lead to system compromise?
Yes, exploiting the vulnerability could allow an attacker to execute arbitrary code on the affected system.