Published: 18/03/2010 Updated: 14/07/2021

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango prior to 1.27.1 allows context-dependent malicious users to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome pango

Synopsis Moderate: pango security update Type/Severity Security Advisory: Moderate Topic Updated pango and evolution28-pango packages that fix one security issueare now available for Red Hat Enterprise Linux 3, 4, and 5This update has been rated as having moderate security impact by the RedHat Security Res ...

Debian Bug report logs - #574021 CVE-2010-0421: libpangoft2 segfaults on forged font files Package: pango10; Maintainer for pango10 is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Mon, 15 Mar 2010 18:52:12 UTC Severity: grave Tags: ...

Marc Schoenefeld discovered that Pango incorrectly handled certain Glyph Definition (GDEF) tables If a user were tricked into displaying text with a specially-crafted font, an attacker could cause Pango to crash, resulting in a denial of service This issue only affected Ubuntu 804 LTS and 910 (CVE-2010-0421) ...

Marc Schoenefeld discovered an improper input sanitization in Pango, a library for layout and rendering of text, leading to array indexing error If a local user was tricked into loading a specially-crafted font file in an application, using the Pango font rendering library, it could lead to denial of service (application crash) For the stable dis ...

CWE-119 http://www.securityfocus.com/bid/38760 https://bugzilla.redhat.com/show_bug.cgi?id=555831 http://securitytracker.com/id?1023711 http://ftp.gnome.org/pub/GNOME/sources/pango/1.27/pango-1.27.1.tar.bz2 http://www.redhat.com/support/errata/RHSA-2010-0140.html http://www.vupen.com/english/advisories/2010/0627 http://secunia.com/advisories/39041 http://www.vupen.com/english/advisories/2010/0661 http://www.debian.org/security/2010/dsa-2019 http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:121 http://www.vupen.com/english/advisories/2010/1552 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9417 https://access.redhat.com/errata/RHSA-2010:0140 https://usn.ubuntu.com/1082-1/https://nvd.nist.gov

CVE-2010-0421

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect