5 results (0.010 seconds)

CVSS: 9.3EPSS: 2%CPEs: 16EXPL: 0

CVE-2011-3193 – qt/harfbuzz buffer overflow

https://notcve.org/view.php?id=CVE-2011-3193

Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file. Desbordamiento de buffer de memoria dinámica en la función Lookup_MarkMarkPos del módulo HarfBuzz (harfbuzz-gpos.c), tal como se usa en Qt anteriores a 4.7.4 y Pango. Permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un archivo de fuentes modificado. • http://cgit.freedesktop.org/harfbuzz.old/commit/?id=81c8ef785b079980ad5b46be4fe7c7bf156dbf65 http://cgit.freedesktop.org/harfbuzz/commit/src/harfbuzz-gpos.c?id=da2c52abcd75d46929b34cad55c4fb2c8892bc08 http://git.gnome.org/browse/pango/commit/pango/opentype/harfbuzz-gpos.c?id=a7a715480db66148b1f487528887508a7991dcd0 http://lists.opensuse.org/opensuse-updates/2011-10/msg00007.html http://lists.opensuse.org/opensuse-updates/2011-10/msg00008.html http://rhn.redhat.com/errata/RHSA-2011-1323.html http://rhn.redhat.com/errata/RH • CWE-787: Out-of-bounds Write •

CVSS: 6.8EPSS: 13%CPEs: 2EXPL: 0

CVE-2011-0064 – pango: missing memory reallocation failure checking in hb_buffer_ensure

https://notcve.org/view.php?id=CVE-2011-0064

The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index. La función hb_buffer_ensure en hb-buffer.c de HarfBuzz, como el usuado en Pango v1.28.3,Firefox otros productos, no verifica que las reasignaciones de memoria sean exitosas, lo que permite a atacantes remotos provocar una denegación de servicio (desreferenciar el puntero a NULL y bloqueo de la aplicación) o posiblemente ejecutar código arbitrario a través de datos manipulados con fuente OpenType que provoca el uso de un índice incorrecto. • http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://secunia.com/advisories/43559 http://secunia.com/advisories/43572 http://secunia.com/advisories/43578 http://secunia.com/advisories/43800 http://securitytracker.com/id?1025145 http://www.debian.org/security/2011/dsa-2178 http://www.mandriva.com/security& •

CVSS: 7.6EPSS: 17%CPEs: 39EXPL: 5

CVE-2011-0020 – Pango Font Parsing - 'pangoft2-render.c' Heap Corruption

https://notcve.org/view.php?id=CVE-2011-0020

Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object. Desbordamiento de búfer basado en memoria dinámica en la función pango_ft2_font_render_box_glyph en pango/pangoft2-render.c de libpango en Pango v1.28.3 y anteriores ,cuando el Backend FreeType2 está activo permite a atacantes remotos causar una denegación de servicio (cuelgue) o ejecutar código arbitrario a través de una a través de un archivo de fuentes manipulado, relacionado con una estuctura Glyph para un objeto de FT_Bitmap. • https://www.exploit-db.com/exploits/35232 http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://openwall.com/lists/oss-security/2011/01/18/6 http://openwall.com/lists/oss-security/2011/01/20/2 http://osvdb.org/70596 http://secunia.com/advisories/42934 http://secunia.com/advisories/43100 http://www.redhat.com/support/errata/RHSA-2011-0180.html http://www.securityfocus.com/bid/45842 http://www.securitytracker.com/id?1024994 http://w • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2010-0421 – libpangoft2 segfaults on forged font files

https://notcve.org/view.php?id=CVE-2010-0421

Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database. Error de índice de un Array en la anteriores a v1.27.1 permite a atacantes , dependiendo del contexto, provocar una denegación de servicio (caída de la aplicación) a través de un fichero de fuentes modificado, relativo a la construcción de de una tabla sintética Glyph Definition (también conocida como GDEF) mediante el uso del mapa de caracteres de esta fuente y las propiedades de la abse de datos UNICODE. • http://ftp.gnome.org/pub/GNOME/sources/pango/1.27/pango-1.27.1.tar.bz2 http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/39041 http://securitytracker.com/id?1023711 http://www.debian.org/security/2010/dsa-2019 http://www.mandriva.com/security/advisories?name=MDVSA-2010:121 http:& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 6.8EPSS: 0%CPEs: 11EXPL: 1

CVE-2009-1194 – pango: pango_glyph_string_set_size integer overflow

https://notcve.org/view.php?id=CVE-2009-1194

Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox. Un desbordamiento de entero en la función pango_glyph_string_set_size en pango/glyphstring.c en Pango antes de la versión v1.24 permite causar una denegación de servicio (mediante caída de la aplicación) a atacantes dependientes del contexto y posiblemente también ejecutar código arbitrario a través de una cadena glifo demasiado larga que desencadena un desbordamiento de búfer basado en montículo, como se ha demostrado por un valor document.location demasiado largo en Firefox. • http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html http://osvdb.org/54279 http://secunia.com/advisories/35018 http://secunia.com/advisories/35021 http://secunia.com/advisories/35027 http://secunia.com/advisories/35038 http://secunia.com/advisories/3 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •