Scientific Linux Security Update : pango on SL3.x, SL4.x, SL5.x i386/x86_64

Medium Nessus Plugin ID 60582

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Will Drewry discovered an integer overflow flaw in Pango's pango_glyph_string_set_size() function. If an attacker is able to pass an arbitrarily long string to Pango, it may be possible to execute arbitrary code with the permissions of the application calling Pango.
(CVE-2009-1194)

After installing this update, you must restart your system or restart the X server for the update to take effect. Note: Restarting the X server closes all open applications and logs you out of your session.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?54dc7fd5

Plugin Details

Severity: Medium

ID: 60582

File Name: sl_20090508_pango_on_SL3_x.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2012/08/01

Updated: 2019/01/02

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Patch Publication Date: 2009/05/08

Reference Information

CVE: CVE-2009-1194

CWE: 189