PT-2011-1053 · Pango+2 · Pango+2

Published 2011-03-01 · Updated 2024-06-15 · CVE-2011-0064

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HarfBuzz (affected versions not specified) Pango version 1.28.3

Description The issue is related to the hb buffer ensure function in HarfBuzz, which is used in Pango and other products. This function does not verify that memory reallocations succeed, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted OpenType font data. The vulnerability can be exploited remotely and may lead to a disruption of confidentiality, integrity, and availability of protected information.

Recommendations For Pango version 1.28.3, update to a newer version that addresses the issue. For HarfBuzz, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-03326

CVE-2011-0064

DSA-2178-1

OPENSUSE-SU-2024:10578-1

RHSA-2011:0309

RHSA-2011_0309

ROSA-SA-2024-2371

Affected Products

Harfbuzz

Pango

Red Hat

References · 127

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/mpgn/CRIME-poc · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• https://bdu.fstec.ru/vul/2023-07671 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-7152 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4578 · Security Note
• https://osv.dev/vulnerability/CVE-2011-0064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4575 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/699325 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6911 · Security Note
• http://vupen.com/english/advisories/2011/0543 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10578-1 · Vendor Advisory