An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.

Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

A heap-based buffer overflow, leading to array index error was found in the way the Pango font rendering library rendered glyph box for certain FTBitmap objects, when the FreeType2 Pango back end was used for rendering. If an attacker created a specially-crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library and FreeType2 Pango back end was used for rendering, it could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

References: [1] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616

CVE Request: [2] http://www.openwall.com/lists/oss-security/2011/01/18/6

Public PoC: [3] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1 (malicious font) [4] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2 (sample text file to trigger the crash)

Will Drewry reported an integer overflow flaw in pango's pangoglyphstringsetsize in pango/glyphstring.c:

61 while (newlen > string->space) 62 { 63 if (string->space == 0) 64 string->space = 1; 65 else 66 string->space = 2; 67 68 if (string->space < 0) 69 { 70 gwarning ("glyph string length overflows maximum integer size, truncated"); 71 newlen = string->space = GMAXINT - 8; 72 } 73 } 74 75 string->glyphs = grealloc (string->glyphs, string->space sizeof (PangoGlyphInfo));

string->space is checked against overflow when doubling it, but is not protected against overflow when multiplied by sizeof(PangoGlyphInfo).

Upstream fix: http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e

Acknowledgements:

Red Hat would like to thank Will Drewry for reporting this issue.

Integer overflow in the pangoglyphstringsetsize function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.

Marc Schoenefeld found an improper input sanitization, leading to array indexing error, in the way Pango font rendering library synthesized Glyph Definition Table (GDEF) from the font's character map and the Unicode property database. If a local user was tricked into loading a specially-crafted font file in an application, using the Pango font rendering library, it could lead to denial of service (relevant application crash).

A heap-based buffer overflow, leading to array index error was found in the way the Pango font rendering library rendered glyph box for certain FTBitmap objects, when the FreeType2 Pango back end was used for rendering. If an attacker created a specially-crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library and FreeType2 Pango back end was used for rendering, it could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

References: [1] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616

CVE Request: [2] http://www.openwall.com/lists/oss-security/2011/01/18/6

Public PoC: [3] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/1 (malicious font) [4] https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616/comments/2 (sample text file to trigger the crash)

Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Host header, can cause the VPN client to redirect or forward HTTP requests to servers other than those originally intended, leading to consequences such as open redirects or delivery of traffic to infrastructure controlled by an attacker. This does not imply a flaw in the target applications, but in how the VPN client internally handles outgoing headers and requests.