Published: 07/03/2011 Updated: 14/07/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote malicious users to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome pango 1.28.3
mozilla firefox

Marc Schoenefeld discovered that Pango incorrectly handled certain Glyph Definition (GDEF) tables If a user were tricked into displaying text with a specially-crafted font, an attacker could cause Pango to crash, resulting in a denial of service This issue only affected Ubuntu 804 LTS and 910 (CVE-2010-0421) ...

NVD-CWE-Other http://www.debian.org/security/2011/dsa-2178 http://www.vupen.com/english/advisories/2011/0558 http://www.securityfocus.com/bid/46632 https://bugzilla.novell.com/show_bug.cgi?id=672502 http://www.vupen.com/english/advisories/2011/0555 http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9 http://www.ubuntu.com/usn/USN-1082-1 http://secunia.com/advisories/43559 http://securitytracker.com/id?1025145 http://secunia.com/advisories/43572 http://secunia.com/advisories/43578 http://www.redhat.com/support/errata/RHSA-2011-0309.html https://bugzilla.mozilla.org/show_bug.cgi?id=606997 http://www.vupen.com/english/advisories/2011/0543 https://build.opensuse.org/request/show/63070 https://bugzilla.redhat.com/show_bug.cgi?id=678563 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:040 http://www.vupen.com/english/advisories/2011/0584 http://secunia.com/advisories/43800 http://www.vupen.com/english/advisories/2011/0683 http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html https://exchange.xforce.ibmcloud.com/vulnerabilities/65770 https://usn.ubuntu.com/1082-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2011-0064

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect