Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

The version of pango installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-1010238 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2582 advisory.

  - pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for pango is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango forms the core of text and font handling for the GTK+ widget toolkit.

Security Fix(es) :

* pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is : The heap based buffer overflow can be used to get code execution.
The component is : function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pango packages installed that are affected by a vulnerability:

  - Gnome Pango 1.42 and later is affected by: Buffer     Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is:
    function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack     vector is: Bug can be used when application pass invalid     utf-8 strings to functions like pango_itemize.
    (CVE-2019-1010238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the pango package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Gnome Pango 1.42 and later is affected by: Buffer     Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is:
    function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack     vector is: Bug can be used when application pass     invalid utf-8 strings to functions like     pango_itemize.(CVE-2019-1010238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3234 advisory.

    Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango     forms the core of text and font handling for the GTK+ widget toolkit.

    Security Fix(es):

    * pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pango packages installed that are affected by a vulnerability:

  - Gnome Pango 1.42 and later is affected by: Buffer     Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is:
    function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack     vector is: Bug can be used when application pass invalid     utf-8 strings to functions like pango_itemize.
    (CVE-2019-1010238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the pango packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Gnome Pango 1.42 and later is affected by: Buffer     Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is:
    function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack     vector is: Bug can be used when application pass     invalid utf-8 strings to functions like     pango_itemize.(CVE-2019-1010238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for pango is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango forms the core of text and font handling for the GTK+ widget toolkit.

Security Fix(es) :

* pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote host is affected by the vulnerability described in GLSA-201909-03 (Pango: Buffer overflow)

    A buffer overflow has been discovered in Pango&rsquo;s       pango_log2vis_get_embedding_levels function.
  Impact :

    A remote attacker could entice a user to process a specially crafted       string with functions like pango_itemize, possibly resulting in execution       of arbitrary code with the privileges of the process or a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2019-1010238

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2582 advisory.

    Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango     forms the core of text and font handling for the GTK+ widget toolkit.

    Security Fix(es):

    * pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2571 advisory.

    Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango     forms the core of text and font handling for the GTK+ widget toolkit.

    Security Fix(es):

    * pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2582 advisory.

    - Security fix for CVE-2019-1010238

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - pango: pango_log2vis_get_embedding_levels() heap-based     buffer overflow (CVE-2019-1010238)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2571 advisory.

    - Security fix for CVE-2019-1010238

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that Pango incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Benno Fuenfstueck discovered that Pango, a library for layout and rendering of text with an emphasis on internationalization, is prone to a heap-based buffer overflow flaw in the pango_log2vis_get_embedding_levels function. An attacker can take advantage of this flaw for denial of service or potentially the execution of arbitrary code.

ID	Name	Product	Family	Severity
173014	CBL Mariner 2.0 Security Update: pango (CVE-2019-1010238)	Nessus	MarinerOS Local Security Checks	critical
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	critical
145586	CentOS 8 : pango (CESA-2019:2582)	Nessus	CentOS Local Security Checks	critical
144248	Virtuozzo 7 : pango / pango-devel / pango-tests (VZLSA-2019-2571)	Nessus	Virtuozzo Local Security Checks	critical
138922	FreeBSD : pango -- buffer overflow (456375e1-cd09-11ea-9172-4c72b94353b5)	Nessus	FreeBSD Local Security Checks	critical
132477	NewStart CGSL CORE 5.05 / MAIN 5.05 : pango Vulnerability (NS-SA-2019-0232)	Nessus	NewStart CGSL Local Security Checks	critical
131509	EulerOS Virtualization for ARM 64 3.0.3.0 : pango (EulerOS-SA-2019-2344)	Nessus	Huawei Local Security Checks	critical
130381	RHEL 7 : pango (RHSA-2019:3234)	Nessus	Red Hat Local Security Checks	critical
129893	NewStart CGSL CORE 5.04 / MAIN 5.04 : pango Vulnerability (NS-SA-2019-0191)	Nessus	NewStart CGSL Local Security Checks	critical
129447	EulerOS 2.0 SP8 : pango (EulerOS-SA-2019-2088)	Nessus	Huawei Local Security Checks	critical
129018	CentOS 7 : pango (CESA-2019:2571)	Nessus	CentOS Local Security Checks	critical
128592	GLSA-201909-03 : Pango: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
128432	Fedora 29 : pango (2019-155e34df5a)	Nessus	Fedora Local Security Checks	critical
128408	RHEL 8 : pango (RHSA-2019:2582)	Nessus	Red Hat Local Security Checks	critical
128407	RHEL 7 : pango (RHSA-2019:2571)	Nessus	Red Hat Local Security Checks	critical
128405	Oracle Linux 8 : pango (ELSA-2019-2582)	Nessus	Oracle Linux Local Security Checks	critical
128311	Scientific Linux Security Update : pango on SL7.x x86_64 (20190828)	Nessus	Scientific Linux Local Security Checks	critical
128298	Oracle Linux 7 : pango (ELSA-2019-2571)	Nessus	Oracle Linux Local Security Checks	critical
128040	Fedora 30 : pango (2019-547be4a683)	Nessus	Fedora Local Security Checks	critical
127798	Ubuntu 19.04 : Pango vulnerability (USN-4081-1)	Nessus	Ubuntu Local Security Checks	critical
127492	Debian DSA-4496-1 : pango1.0 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-1010238

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical