Fluid Attacks Database

Description

The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	pango1.0	>=0 <1.28.3-2~sid1	1.28.3-2~sid1
debian 11	pango1.0	>=0 <1.28.3-2~sid1	1.28.3-2~sid1
debian 14	pango1.0	>=0 <1.28.3-2~sid1	1.28.3-2~sid1
debian 13	pango1.0	>=0 <1.28.3-2~sid1	1.28.3-2~sid1
rpm rhel6	pango	<0:1.28.1-3.el6_0.5	0:1.28.1-3.el6_0.5

Aliases

1. CVE-2011-00642. NVD-2011-00643. OSV-DEBIAN-2011-00644. OSV-2011-00645. SECURITY-TRACKER-CVE-2011-0064

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.