libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to
    cause a denial of service (application crash) or possibly have unspecified other impact via crafted text
    with invalid Unicode sequences. (CVE-2018-15120)

The remote host is affected by the vulnerability described in GLSA-201811-07 (Pango: Denial of service)

    Processing certain invalid Emoji sequences in a GTK+ application can       trigger a reachable assertion resulting in an application crash.
  Impact :

    A remote attacker could provide a specially crafted Emoji sequences,       possibly resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for pango fixes the following issue :

Security issue fixed :

  - CVE-2018-15120: Fixed a denial of service when parsing     emoji (bsc#1103877)

This update was imported from the SUSE:SLE-15:Update update project.

This update for pango fixes the following issues :

Security issue fixed :

CVE-2018-15120: Fixed a denial of service when parsing emoji (bsc#1103877)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-15120

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3750-1 advisory.

    Jeffrey M. discovered that Pango incorrectly handled certain files. An attacker could possibly use this     issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
406205	Alpine: pango: security update to 1.40.14-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406205	Alpine: pango: security update to 1.40.14-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
124213	GLSA-201811-07 : Pango: Denial of service	Nessus	Gentoo Local Security Checks	medium
123307	openSUSE Security Update : pango (openSUSE-2019-707)	Nessus	SuSE Local Security Checks	medium
120101	SUSE SLED15 / SLES15 Security Update : pango (SUSE-SU-2018:2763-1)	Nessus	SuSE Local Security Checks	medium
117864	FreeBSD : pango -- remote DoS vulnerability (5a757a31-f98e-4bd4-8a85-f1c0f3409769)	Nessus	FreeBSD Local Security Checks	medium
117657	openSUSE Security Update : pango (openSUSE-2018-1026)	Nessus	SuSE Local Security Checks	medium
117490	Fedora 27 : pango (2018-83116f8692)	Nessus	Fedora Local Security Checks	medium
112084	Ubuntu 18.04 LTS : Pango vulnerability (USN-3750-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2018-15120

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium