Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-15:01 advisory.

    Pango is a system for layout and rendering of internationalized text.
    Security issues fixed with this release:
    CVE-2011-0020     Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in     libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote     attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a     crafted font file, related to the glyph box for an FT_Bitmap object.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Specially crafted font files could cause a heap corruption in applications linked against pango (CVE-2011-0064, CVE-2011-0020).

The remote host is affected by the vulnerability described in GLSA-201405-13 (Pango: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pango. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to load specially       crafted text using an application linked against Pango, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0180 advisory.

    - Prevent heap corruption with malformed fonts. (CVE-2011-0020)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An input sanitization flaw, leading to a heap-based buffer overflow, was found in the way Pango displayed font files when using the FreeType font engine back end. If a user loaded a malformed font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-0020)

After installing the updated packages, you must restart your system or restart your X session for the update to take effect.

The following bug has been fixed :

  - Specially crafted font files could cause a heap     corruption in applications linked against pango.
    (CVE-2011-0020)

Specially crafted font files could cause a heap corruption in applications linked against pango. (CVE-2011-0064 / CVE-2011-0020)

Marc Schoenefeld discovered that Pango incorrectly handled certain Glyph Definition (GDEF) tables. If a user were tricked into displaying text with a specially crafted font, an attacker could cause Pango to crash, resulting in a denial of service. This issue only affected Ubuntu 8.04 LTS and 9.10. (CVE-2010-0421)

Dan Rosenberg discovered that Pango incorrectly handled certain FT_Bitmap objects. If a user were tricked into displaying text with a specially- crafted font, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2011-0020)

It was discovered that Pango incorrectly handled certain memory reallocation failures. If a user were tricked into displaying text in a way that would cause a reallocation failure, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2011-0064).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated pango and evolution28-pango packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Pango is a library used for the layout and rendering of internationalized text.

An input sanitization flaw, leading to a heap-based buffer overflow, was found in the way Pango displayed font files when using the FreeType font engine back end. If a user loaded a malformed font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-0020)

Users of pango and evolution28-pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, you must restart your system or restart your X session for the update to take effect.

A vulnerability has been found and corrected in pango :

Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object (CVE-2011-0020).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 4 / 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0180 advisory.

  - pango: Heap-based buffer overflow by rendering glyph box for certain FT_Bitmap objects (CVE-2011-0020)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
283982	MiracleLinux 3 : pango-1.14.9-8.AXS3.2 (AXSA:2011-15:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
75599	openSUSE Security Update : libpango-1_0-0 (openSUSE-SU-2011:0221-1)	Nessus	SuSE Local Security Checks	Local	high
74056	GLSA-201405-13 : Pango: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
68188	Oracle Linux 5 / 6 : pango (ELSA-2011-0180)	Nessus	Oracle Linux Local Security Checks	Local	critical
60944	Scientific Linux Security Update : pango on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	high
57187	SuSE 10 Security Update : firefox3-pango (ZYPP Patch Number 7459)	Nessus	SuSE Local Security Checks	Local	high
54612	SuSE 10 Security Update : firefox3-pango (ZYPP Patch Number 7460)	Nessus	SuSE Local Security Checks	Local	high
53753	openSUSE Security Update : libpango-1_0-0 (openSUSE-SU-2011:0221-1)	Nessus	SuSE Local Security Checks	Local	high
52960	SuSE 11.1 Security Update : pango (SAT Patch Number 4065)	Nessus	SuSE Local Security Checks	Local	high
52529	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : pango1.0 vulnerabilities (USN-1082-1)	Nessus	Ubuntu Local Security Checks	Local	high
51886	CentOS 4 : pango (CESA-2011:0180)	Nessus	CentOS Local Security Checks	Local	high
51865	Mandriva Linux Security Advisory : pango (MDVSA-2011:020)	Nessus	Mandriva Local Security Checks	Local	high
51811	RHEL 4 / 5 / 6 : pango (RHSA-2011:0180)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2011-0020

critical

Tenable Plugins

critical

high

critical

critical

high

high

high

high

high

high

high

high

critical