Heap-based buffer overflow in the LookupMarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
A heap-based buffer overflow, leading to array index error was found in the way the Pango font rendering library rendered glyph box for certain FTBitmap objects, when the FreeType2 Pango back end was used for rendering. If an attacker created a specially-crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library and FreeType2 Pango back end was used for rendering, it could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
References: [1] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616
CVE Request: [2] http://www.openwall.com/lists/oss-security/2011/01/18/6
Public PoC: [3] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1 (malicious font) [4] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2 (sample text file to trigger the crash)
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pangolog2visgetembeddinglevels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pangoitemize.
External References:
https://packetstormsecurity.com/files/153838/USN-4081-1.txt https://gitlab.gnome.org/GNOME/pango/issues/342
It was discovered that pango did not check for memory reallocation failures in hbbufferensure() function. This could trigger a NULL pointer dereference in hbbufferaddglyph(), where possibly untrusted input is used as an index used for accessing members of the incorrectly reallocated array, resulting in the use of NULL address as the base array address. This can result in application crash or, possibly, code execution.
It was demonstrated that it's possible to trigger this flaw in Firefox via a specially crafted web page.
Mozilla bug report (currently not public): https://bugzilla.mozilla.org/showbug.cgi?id=606997
Fix in the harfbuzz git: http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2e
Acknowledgements:
Red Hat would like to thank Mozilla Security Team for reporting this issue.
Integer overflow in the pangoglyphstringsetsize function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
Marc Schoenefeld found an improper input sanitization, leading to array indexing error, in the way Pango font rendering library synthesized Glyph Definition Table (GDEF) from the font's character map and the Unicode property database. If a local user was tricked into loading a specially-crafted font file in an application, using the Pango font rendering library, it could lead to denial of service (relevant application crash).