https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Bug ID: 1737785 Summary: CVE-2019-1010238 pango: heap based buffer overflow can be used to get code execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: mrehak@redhat.com CC: caillon+fedoraproject@gmail.com, eng-i18n-bugs@redhat.com, fonts-bugs@lists.fedoraproject.org, gnome-sig@lists.fedoraproject.org, i18n-bugs@lists.fedoraproject.org, john.j5live@gmail.com, mclasen@redhat.com, pwu@redhat.com, rhughes@redhat.com, rstrode@redhat.com, sandmann@redhat.com, tagoh@redhat.com Target Milestone: --- Classification: Other
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
External References:
https://packetstormsecurity.com/files/153838/USN-4081-1.txt
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Marian Rehak mrehak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1737786
--- Comment #1 from Marian Rehak mrehak@redhat.com --- Created pango tracking bugs for this issue:
Affects: fedora-all [bug 1737786]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1737786 [Bug 1737786] CVE-2019-1010238 pango: heap based buffer overflow can be used to get code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Marian Rehak mrehak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1737787
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
--- Comment #2 from Stefan Cornelius scorneli@redhat.com --- Patch: https://gitlab.gnome.org/GNOME/pango/commit/490f8979a260c16b1df055eab386345d...
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2019-1010238 pango: |CVE-2019-1010238 pango: |heap based buffer overflow |pango_log2vis_get_embedding |can be used to get code |_levels() heap based buffer |execution |overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1738462, 1738460, 1738459, | |1738461
https://bugzilla.redhat.com/show_bug.cgi?id=1737785 Bug 1737785 depends on bug 1737786, which changed state.
Bug 1737786 Summary: CVE-2019-1010238 pango: pango_log2vis_get_embedding_levels() heap based buffer overflow [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1737786
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2019-1010238 pango: |CVE-2019-1010238 pango: |pango_log2vis_get_embedding |pango_log2vis_get_embedding |_levels() heap based buffer |_levels() heap-based buffer |overflow |overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:2571 https://access.redhat.com/errata/RHSA-2019:2571
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2571
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2019-08-28 19:07:22
--- Comment #7 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-1010238
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2019:2582 https://access.redhat.com/errata/RHSA-2019:2582
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2582
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2659
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2664
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2665
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2666
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2675
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2686
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
--- Comment #13 from Jens Petersen petersen@redhat.com --- Anyway I requested 7.6.z now in bug 1738459 - I hope that works even though the bug is closed since we shipped the 7.7.z update.
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2738
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2739
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2742
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2776
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2787
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2810
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2911
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Marian Rehak mrehak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1756290
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:2965
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2019:3036
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7.6 Extended Update Support
Via RHSA-2019:3234 https://access.redhat.com/errata/RHSA-2019:3234
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3234
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A buffer overflow flaw was found in Gnome Pango. When invalid utf-8 strings are passed to functions, a heap-based buffer overflow can occur that could lead to code execution. The highest threat from this vulnerability is data confidentiality and integrity as well as system availability.
i18n-bugs@lists.fedoraproject.org