PT-2019-4756 · Gnome+8 · Gedit+10
Alex Murray
·
Publicado
2019-11-07
·
Atualizado
2025-10-20
·
CVE-2019-18397
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNU FriBidi versions 1.0.7 and earlier
Description
A buffer overflow in the
fribidi get par embedding levels ex() function allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user. This issue affects applications that use FriBidi for text layout calculations, such as GNOME or GTK+ based applications that use Pango for text layout. Examples of exploitation include constructing a crafted text file to be opened in GEdit or a crafted IRC message to be viewed in HexChat.Recommendations
For GNU FriBidi versions 1.0.7 and earlier, consider updating to a version later than 1.0.7 to resolve the issue. As a temporary workaround, consider restricting the use of the
fribidi get par embedding levels ex() function until a patch is available. Avoid using applications that rely on FriBidi for text layout calculations with untrusted text content until the issue is resolved.Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Gedit
Gnome
Gnu Fribidi
Gtk+
Hexchat
Pango
Red Hat
Suse
Ubuntu