PT-2012-3107 · Fribidi · Pyfribidi

Vincent Danen · Publicado 2012-08-26 · Atualizado 2022-05-17 · CVE-2012-1176

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyFriBidi versions prior to 0.11.0

Description The issue is related to a buffer overflow in the fribidi utf8 to unicode function, which can be exploited by remote attackers to cause a denial of service, resulting in an application crash. This can be achieved by sending a specifically crafted 4-byte UTF-8 sequence.

Recommendations For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider restricting input to prevent the processing of malicious UTF-8 sequences until a patch is applied.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-1176

GHSA-6476-G47X-H3C7

PYSEC-2012-11

Produtos afetados

Pyfribidi

Referências · 26

• https://github.com/pypa/advisory-database/tree/main/vulns/pyfribidi/PYSEC-2012-11.yaml · Nota
• https://github.com/pediapress/pyfribidi/commit/d2860c655357975e7b32d84e6b45e98f0dcecd7a · Nota
• https://github.com/pediapress/pyfribidi/issues/2 · Nota
• https://github.com/pediapress/pyfribidi/issues/2%29: · Nota
• https://github.com/pediapress/pyfribidi · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075293.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1176 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076053.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-1176 · Aviso do Fabricante
• http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/aacd036037217998/8d095f85f3665bff?lnk=raot · Nota
• https://osv.dev/vulnerability/GHSA-6476-g47x-h3c7 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=663189 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076038.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/03/14/4 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-1176 · Aviso do Fabricante