pango1.0: integer overflow in heap allocation size calculations

Debian Bug report logs - #527474
pango1.0: integer overflow in heap allocation size calculations

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>

To: submit@bugs.debian.org

Subject: pango1.0: integer overflow in heap allocation size calculations

Date: Thu, 7 May 2009 15:51:48 -0400

package: pango
severity: grave
tags: security

Hi,

The following CVE (Common Vulnerabilities & Exposures) id was
published for pango1.0.

CVE-2009-1194[0]:
|Pango is a library for laying out and rendering text, with an emphasis
|on internationalization.  Pango suffers from a multiplicative integer
|overflow which may lead to a potentially exploitable, heap overflow
|depending on the calling conditions.  For example, this vulnerability is
|remotely reachable in Firefox by creating an overly large
|document.location value but only results in a process-terminating,
|allocation error (denial of service).
|
|The affected function is pango_glyph_string_set_size. An overflow check
|when doubling the size neglects the overflow possible on the subsequent
|allocation:
|
|  string->glyphs = g_realloc (string->glyphs, string->space *
|                              sizeof (PangoGlyphInfo));
|
|Note that other font rendering subsystems suffer from similar issues and
|should be cross-checked by maintainers.

Please coordinate with the security team (team@security.debian.org)
to prepare updates for the stable releases.

See also see USN-773-1 [1].

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1194
    http://security-tracker.debian.net/tracker/CVE-2009-1194
[1] http://www.ubuntu.com/usn/USN-773-1

Message #12 received at 527474@bugs.debian.org (full text, mbox, reply):

From: Marc Deslauriers <marc.deslauriers@canonical.com>

To: 527474@bugs.debian.org

Subject: Re: pango1.0: integer overflow in heap allocation size calculations

Date: Fri, 08 May 2009 08:21:26 -0400

Here is the upstream commit:

http://git.gnome.org/cgit/pango/commit/?id=4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e

Message #17 received at 527474-done@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: 527474-done@bugs.debian.org

Subject: pango issue fixed in sid

Date: Mon, 11 May 2009 01:25:02 +1000

[Message part 1 (text/plain, inline)]

Version: 1.24.0-2

The bug has been fixed upstream and the fix made it into sid/squeeze.

Cheers
Steffen

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.