CVE-2011-0020
Fixed in a distro release EPSS 19%
Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.
Products: gnome pango, pango
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pango1.0 | 1.28.3-1+squeeze1 |
| Debian 13 | pango1.0 | 1.28.3-1+squeeze1 |
| Debian 14 | pango1.0 | 1.28.3-1+squeeze1 |
| Red Hat Enterprise Linux 4 | evolution28-pango | 0:1.14.9-13.el4_10 |
| Red Hat Enterprise Linux 4 | evolution28-pango-debuginfo | 0:1.14.9-13.el4_10 |
| Red Hat Enterprise Linux 4 | evolution28-pango-devel | 0:1.14.9-13.el4_10 |
| Red Hat Enterprise Linux 5 | pango | 0:1.14.9-8.el5_6.2 |
| Red Hat Enterprise Linux 5 | pango-debuginfo | 0:1.14.9-8.el5_6.2 |
| Red Hat Enterprise Linux 5 | pango-devel | 0:1.14.9-8.el5_6.2 |
| Red Hat Enterprise Linux 6 | pango | 0:1.28.1-3.el6_0.3 |
| Red Hat Enterprise Linux 6 | pango-debuginfo | 0:1.28.1-3.el6_0.3 |
| Red Hat Enterprise Linux 6 | pango-devel | 0:1.28.1-3.el6_0.3 |
| openSUSE Tumbleweed | pango | 1.40.3-1.1 |