Security
Security
A buffer overflow in Pango might allow an attacker to execute arbitrary code.
| Package | x11-libs/pango on all architectures |
|---|---|
| Affected versions | < 1.42.4-r2 |
| Unaffected versions | >= 1.42.4-r2 |
Pango is a library for layout and rendering of internationalized text.
A buffer overflow has been discovered in Pango’s pango_log2vis_get_embedding_levels function.
A remote attacker could entice a user to process a specially crafted string with functions like pango_itemize, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All Pango users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/pango-1.42.4-r2"
Release date
September 06, 2019
Latest revision
September 06, 2019: 1
Severity
normal
Exploitable
remote
Bugzilla entries