Pango: Buffer overflow — GLSA 201909-03

A buffer overflow in Pango might allow an attacker to execute arbitrary code.

Affected packages

x11-libs/pango on all architectures
Affected versions < 1.42.4-r2
Unaffected versions >= 1.42.4-r2

Background

Pango is a library for layout and rendering of internationalized text.

Description

A buffer overflow has been discovered in Pango’s pango_log2vis_get_embedding_levels function.

Impact

A remote attacker could entice a user to process a specially crafted string with functions like pango_itemize, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Pango users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-libs/pango-1.42.4-r2"
 

References

Release date
September 06, 2019

Latest revision
September 06, 2019: 1

Severity
normal

Exploitable
remote

Bugzilla entries