libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.

The remote host is affected by the vulnerability described in GLSA-201811-07 (Pango: Denial of service)

    Processing certain invalid Emoji sequences in a GTK+ application can       trigger a reachable assertion resulting in an application crash.
  Impact :

    A remote attacker could provide a specially crafted Emoji sequences,       possibly resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for pango fixes the following issue :

Security issue fixed :

  - CVE-2018-15120: Fixed a denial of service when parsing     emoji (bsc#1103877)

This update was imported from the SUSE:SLE-15:Update update project.

This update for pango fixes the following issues :

Security issue fixed :

CVE-2018-15120: Fixed a denial of service when parsing emoji (bsc#1103877)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-15120

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jeffrey M. discovered that Pango incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124213	GLSA-201811-07 : Pango: Denial of service	Nessus	Gentoo Local Security Checks	medium
123307	openSUSE Security Update : pango (openSUSE-2019-707)	Nessus	SuSE Local Security Checks	high
120101	SUSE SLED15 / SLES15 Security Update : pango (SUSE-SU-2018:2763-1)	Nessus	SuSE Local Security Checks	medium
117864	FreeBSD : pango -- remote DoS vulnerability (5a757a31-f98e-4bd4-8a85-f1c0f3409769)	Nessus	FreeBSD Local Security Checks	medium
117657	openSUSE Security Update : pango (openSUSE-2018-1026)	Nessus	SuSE Local Security Checks	high
117490	Fedora 27 : pango (2018-83116f8692)	Nessus	Fedora Local Security Checks	high
112084	Ubuntu 18.04 LTS : Pango vulnerability (USN-3750-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2018-15120

medium

Tenable Plugins

medium

high

medium

medium

high

high

medium