Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0140 advisory.

    [1.14.9-8.el5]
    - Updated synthetic-gdef patch
    - Resolves: #559169

    [1.14.9-7.el5]
    - Add synthetic-gdef patch
    - Resolves: #559169

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2010-0421 libpangoft2 segfaults on forged font files

An input sanitization flaw, leading to an array index error, was found in the way the Pango font rendering library synthesized the Glyph Definition (GDEF) table from a font's character map and the Unicode property database. If an attacker created a specially crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library, it could cause that application to crash. (CVE-2010-0421)

After installing this update, you must restart your system or restart your X session for this update to take effect.

Marc Schoenefeld discovered that Pango incorrectly handled certain Glyph Definition (GDEF) tables. If a user were tricked into displaying text with a specially crafted font, an attacker could cause Pango to crash, resulting in a denial of service. This issue only affected Ubuntu 8.04 LTS and 9.10. (CVE-2010-0421)

Dan Rosenberg discovered that Pango incorrectly handled certain FT_Bitmap objects. If a user were tricked into displaying text with a specially- crafted font, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2011-0020)

It was discovered that Pango incorrectly handled certain memory reallocation failures. If a user were tricked into displaying text in a way that would cause a reallocation failure, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2011-0064).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of pango fixes a memory corruption bug that can possibly be exploited to execute arbitrary code remotely. This bug could occur while processing fonts from untrusted sources. (CVE-2010-0421)

A vulnerability has been discovered and corrected in pango :

Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database (CVE-2010-0421).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

Specially crafted font files could cause a memory corruption in pango.
Attackers could potentially exploit that to execute arbitrary code (CVE-2010-0421). This has been fixed.

Updated pango and evolution28-pango packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pango is a library used for the layout and rendering of internationalized text.

An input sanitization flaw, leading to an array index error, was found in the way the Pango font rendering library synthesized the Glyph Definition (GDEF) table from a font's character map and the Unicode property database. If an attacker created a specially crafted font file and tricked a local, unsuspecting user into loading the font file in an application that uses the Pango font rendering library, it could cause that application to crash. (CVE-2010-0421)

Users of pango and evolution28-pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, you must restart your system or restart your X session for this update to take effect.

Marc Schoenefeld discovered an improper input sanitization in Pango, a library for layout and rendering of text, leading to array indexing error. If a local user was tricked into loading a specially crafted font file in an application, using the Pango font rendering library, it could lead to denial of service (application crash).

ID	Name	Product	Family	Severity
68007	Oracle Linux 5 : pango (ELSA-2010-0140)	Nessus	Oracle Linux Local Security Checks	medium
60746	Scientific Linux Security Update : pango on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
52529	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : pango1.0 vulnerabilities (USN-1082-1)	Nessus	Ubuntu Local Security Checks	high
49912	SuSE 10 Security Update : pango (ZYPP Patch Number 6895)	Nessus	SuSE Local Security Checks	medium
47115	Mandriva Linux Security Advisory : pango (MDVSA-2010:121)	Nessus	Mandriva Local Security Checks	medium
46668	SuSE9 Security Update : pango (YOU Patch Number 12614)	Nessus	SuSE Local Security Checks	medium
46263	RHEL 3 / 4 / 5 : pango (RHSA-2010:0140)	Nessus	Red Hat Local Security Checks	medium
45540	SuSE 10 Security Update : pango (ZYPP Patch Number 6894)	Nessus	SuSE Local Security Checks	medium
45113	Debian DSA-2019-1 : pango1.0 - missing input sanitization	Nessus	Debian Local Security Checks	medium
45066	CentOS 3 / 4 / 5 : pango (CESA-2010:0140)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2010-0421

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

medium