CVE-2011-0064 The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to caus...
MediumCVSS 6.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME pango | = 1.28.3 | No fix listed |
| mozilla Firefox | All versions | No fix listed |
| debian/pango1.0(Debian:12) | < 1.28.3-2~sid1 | 1.28.3-2~sid1 |
| debian/pango1.0(Debian:13) | < 1.28.3-2~sid1 | 1.28.3-2~sid1 |
| debian/pango1.0(Debian:14) | < 1.28.3-2~sid1 | 1.28.3-2~sid1 |
References
- cgit.freedesktop.org patch
- FEDORA-2011-3194 vendor-advisory
- SUSE-SR:2011:005 vendor-advisory
- 43559 third-party-advisory vendor-advisory
- 43572 third-party-advisory vendor-advisory
- 43578 third-party-advisory vendor-advisory
- 43800 third-party-advisory
- 1025145 vdb-entry
- DSA-2178 vendor-advisory
- MDVSA-2011:040 vendor-advisory
- RHSA-2011:0309 vendor-advisory
- 46632 vdb-entry
- USN-1082-1 vendor-advisory
- ADV-2011-0543 vdb-entry vendor-advisory
- ADV-2011-0555 vdb-entry vendor-advisory
- ADV-2011-0558 vdb-entry vendor-advisory
- ADV-2011-0584 vdb-entry
- ADV-2011-0683 vdb-entry
- bugzilla.mozilla.org
- bugzilla.novell.com
- bugzilla.redhat.com patch
- build.opensuse.org patch
- pango-hbbufferensure-bo(65770) vdb-entry
- Debian Security Tracker CVE-2011-0064 vendor-advisory