PT-2011-1402 · Python+1 · Pyfribidi+1

Vincent Danen · Published 2011-01-11 · Updated 2017-08-17 · CVE-2010-3444

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU FriBidi versions 0.19.1 through 0.19.2 PyFriBidi version 0.10.1

Description The issue is related to a buffer overflow in the log2vis utf8 function, which can be triggered by a crafted Arabic UTF-8 string. This string causes original 2-byte UTF-8 sequences to be transformed into 3-byte sequences, leading to a denial of service (crash) and potentially allowing the execution of arbitrary code.

Recommendations For GNU FriBidi versions 0.19.1 through 0.19.2, consider updating to a newer version that addresses this issue. For PyFriBidi version 0.10.1, consider updating to a newer version that addresses this issue. As a temporary workaround, consider restricting the input of Arabic UTF-8 strings to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-3444

Affected Products

Gnu Fribidi

Pyfribidi

References · 12

• https://osv.dev/vulnerability/CVE-2010-3444 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052935.html · Vendor Advisory
• http://secunia.com/advisories/42868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3444 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052936.html · Vendor Advisory
• http://sourceforge.net/tracker/?func=detail&aid=2676136&group_id=158366&atid=807545 · Patch
• http://vupen.com/english/advisories/2011/0058 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-3444 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3444 · Vendor Advisory
• http://securityfocus.com/bid/43592 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=565997 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64619 · Note