CVE-2009-1194
Fixed in a distro release EPSS 4%
Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
Products: pango
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pango1.0 | 1.24.0-2 |
| Debian 13 | pango1.0 | 1.24.0-2 |
| Debian 14 | pango1.0 | 1.24.0-2 |
| Debian 4.0 | pango1.0 | 1.14.8-5+etch1 |
| Debian 5.0 | pango1.0 | 1.20.5-3+lenny1 |
| Red Hat Enterprise Linux 3 | pango | 0:1.2.5-8 |
| Red Hat Enterprise Linux 3 | pango-debuginfo | 0:1.2.5-8 |
| Red Hat Enterprise Linux 3 | pango-devel | 0:1.2.5-8 |
| Red Hat Enterprise Linux 4 | evolution28-pango | 0:1.14.9-11.el4_7 |
| Red Hat Enterprise Linux 4 | evolution28-pango-debuginfo | 0:1.14.9-11.el4_7 |
| Red Hat Enterprise Linux 4 | evolution28-pango-devel | 0:1.14.9-11.el4_7 |
| Red Hat Enterprise Linux 4 | pango | 0:1.6.0-14.4_7 |
| Red Hat Enterprise Linux 4 | pango-debuginfo | 0:1.6.0-14.4_7 |
| Red Hat Enterprise Linux 4 | pango-devel | 0:1.6.0-14.4_7 |
| Red Hat Enterprise Linux 5 | pango | 0:1.14.9-5.el5_3 |
| Red Hat Enterprise Linux 5 | pango-debuginfo | 0:1.14.9-5.el5_3 |
| Red Hat Enterprise Linux 5 | pango-devel | 0:1.14.9-5.el5_3 |