CVSS: 6.8EPSS: 13%CPEs: 2EXPL: 0CVE-2011-0064 – pango: missing memory reallocation failure checking in hb_buffer_ensure
https://notcve.org/view.php?id=CVE-2011-0064
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index. La función hb_buffer_ensure en hb-buffer.c de HarfBuzz, como el usuado en Pango v1.28.3,Firefox otros productos, no verifica que las reasignaciones de memoria sean exitosas, lo que permite a atacantes remotos provocar una denegación de servicio (desreferenciar el puntero a NULL y bloqueo de la aplicación) o posiblemente ejecutar código arbitrario a través de datos manipulados con fuente OpenType que provoca el uso de un índice incorrecto. • http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://secunia.com/advisories/43559 http://secunia.com/advisories/43572 http://secunia.com/advisories/43578 http://secunia.com/advisories/43800 http://securitytracker.com/id?1025145 http://www.debian.org/security/2011/dsa-2178 http://www.mandriva.com/security& •
CVSS: 7.6EPSS: 17%CPEs: 39EXPL: 5CVE-2011-0020 – Pango Font Parsing - 'pangoft2-render.c' Heap Corruption
https://notcve.org/view.php?id=CVE-2011-0020
Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object. Desbordamiento de búfer basado en memoria dinámica en la función pango_ft2_font_render_box_glyph en pango/pangoft2-render.c de libpango en Pango v1.28.3 y anteriores ,cuando el Backend FreeType2 está activo permite a atacantes remotos causar una denegación de servicio (cuelgue) o ejecutar código arbitrario a través de una a través de un archivo de fuentes manipulado, relacionado con una estuctura Glyph para un objeto de FT_Bitmap. • https://www.exploit-db.com/exploits/35232 http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://openwall.com/lists/oss-security/2011/01/18/6 http://openwall.com/lists/oss-security/2011/01/20/2 http://osvdb.org/70596 http://secunia.com/advisories/42934 http://secunia.com/advisories/43100 http://www.redhat.com/support/errata/RHSA-2011-0180.html http://www.securityfocus.com/bid/45842 http://www.securitytracker.com/id?1024994 http://w • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •