CVE-2019-1010238
Fixed in a distro release EPSS 6%
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
Products: gnome pango
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | pango | 1.42.4-r2 |
| Alpine 3.11 | pango | 1.44.1-r0 |
| Alpine 3.12 | pango | 1.44.1-r0 |
| Alpine 3.13 | pango | 1.44.1-r0 |
| Alpine 3.14 | pango | 1.44.1-r0 |
| Alpine 3.15 | pango | 1.44.1-r0 |
| Alpine 3.16 | pango | 1.44.1-r0 |
| Alpine 3.17 | pango | 1.44.1-r0 |
| Alpine 3.18 | pango | 1.44.1-r0 |
| Alpine 3.19 | pango | 1.44.1-r0 |
| Alpine 3.20 | pango | 1.44.1-r0 |
| Alpine 3.21 | pango | 1.44.1-r0 |
| Alpine 3.22 | pango | 1.44.1-r0 |
| Alpine 3.23 | pango | 1.44.1-r0 |
| Alpine 3.24 | pango | 1.44.1-r0 |
| Alpine 3.9 | pango | 1.42.4-r1 |
| Debian 10 | pango1.0 | 1.42.4-7~deb10u1 |
| Debian 12 | pango1.0 | 1.42.4-7 |
| Debian 13 | pango1.0 | 1.42.4-7 |
| Debian 14 | pango1.0 | 1.42.4-7 |
| Red Hat Enterprise Linux 7 | pango | 0:1.42.4-4.el7_7 |
| Red Hat Enterprise Linux 7 | pango-debuginfo | 0:1.42.4-4.el7_7 |
| Red Hat Enterprise Linux 7 | pango-devel | 0:1.42.4-4.el7_7 |
| Red Hat Enterprise Linux 7 | pango-tests | 0:1.42.4-4.el7_7 |
| Red Hat Enterprise Linux 8 | pango | 0:1.42.4-5.el8_0 |
| Red Hat Enterprise Linux 8 | pango-debuginfo | 0:1.42.4-5.el8_0 |
| Red Hat Enterprise Linux 8 | pango-debugsource | 0:1.42.4-5.el8_0 |
| Red Hat Enterprise Linux 8 | pango-devel | 0:1.42.4-5.el8_0 |
| Red Hat Enterprise Linux 8 | pango-tests-debuginfo | 0:1.42.4-5.el8_0 |
| Red Hat rhel eus 7.6 | pango | 0:1.42.4-3.el7_6 |
| Red Hat rhel eus 7.6 | pango-debuginfo | 0:1.42.4-3.el7_6 |
| Red Hat rhel eus 7.6 | pango-devel | 0:1.42.4-3.el7_6 |
| Red Hat rhel eus 7.6 | pango-tests | 0:1.42.4-3.el7_6 |