RHSA-2011:0180: Moderate: pango security update
Pango is a library used for the layout and rendering of internationalizedtext.An input sanitization flaw, leading to a heap-based buffer overflow, wasfound in the way Pango displayed font files when using the FreeType fontengine back end. If a user loaded a malformed font file with an applicationthat uses Pango, it could cause the application to crash or, possibly,execute arbitrary code with the privileges of the user running theapplication. (CVE-2011-0020)Users of pango and evolution28-pango are advised to upgrade to theseupdated packages, which contain a backported patch to resolve this issue.After installing the updated packages, you must restart your system orrestart your X session for the update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:0180?
The severity of RHSA-2011:0180 is classified as moderate.
How do I fix RHSA-2011:0180?
To fix RHSA-2011:0180, update to the latest version of the affected Pango packages as outlined in the advisory.
What type of vulnerability is RHSA-2011:0180?
RHSA-2011:0180 describes an input sanitization flaw that can lead to a heap-based buffer overflow.
Which versions of Pango are affected by RHSA-2011:0180?
Versions prior to 1.28.1-3.el6_0.3 for RHEL 6 and 1.14.9-8.el5_6.2 for RHEL 5 are affected by RHSA-2011:0180.
What systems are impacted by RHSA-2011:0180?
RHSA-2011:0180 affects RHEL 4, RHEL 5, and RHEL 6 systems running vulnerable versions of the Pango package.