1. CVE-Search
  2. CVE-2019-1010238
ID CVE-2019-1010238
Summary Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
References
Vulnerable Configurations
  • cpe:2.3:a:gnome:pango:1.42.0:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.42.0:*:*:*:*:*:*:*
  • cpe:2.3:a:gnome:pango:1.42.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.42.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnome:pango:1.42.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.42.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnome:pango:1.42.3:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.42.3:*:*:*:*:*:*:*
  • cpe:2.3:a:gnome:pango:1.42.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.42.4:*:*:*:*:*:*:*
  • cpe:2.3:a:gnome:pango:1.43.0:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.43.0:*:*:*:*:*:*:*
  • cpe:2.3:a:gnome:pango:1.44:*:*:*:*:*:*:*
    cpe:2.3:a:gnome:pango:1.44:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:sd-wan_edge:7.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:sd-wan_edge:7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:sd-wan_edge:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:sd-wan_edge:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:sd-wan_edge:8.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:sd-wan_edge:8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 12-04-2022 - 16:51)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • bugzilla
    id 1737785
    title CVE-2019-1010238 pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment pango is earlier than 0:1.42.4-4.el7_7
            oval oval:com.redhat.rhsa:tst:20192571001
          • comment pango is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152116008
        • AND
          • comment pango-devel is earlier than 0:1.42.4-4.el7_7
            oval oval:com.redhat.rhsa:tst:20192571003
          • comment pango-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152116010
        • AND
          • comment pango-tests is earlier than 0:1.42.4-4.el7_7
            oval oval:com.redhat.rhsa:tst:20192571005
          • comment pango-tests is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152116012
    rhsa
    id RHSA-2019:2571
    released 2019-08-28
    severity Important
    title RHSA-2019:2571: pango security update (Important)
  • bugzilla
    id 1737785
    title CVE-2019-1010238 pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 8 is installed
        oval oval:com.redhat.rhba:tst:20193384074
      • OR
        • AND
          • comment pango is earlier than 0:1.42.4-5.el8_0
            oval oval:com.redhat.rhsa:tst:20192582001
          • comment pango is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152116008
        • AND
          • comment pango-debugsource is earlier than 0:1.42.4-5.el8_0
            oval oval:com.redhat.rhsa:tst:20192582003
          • comment pango-debugsource is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20192582004
        • AND
          • comment pango-devel is earlier than 0:1.42.4-5.el8_0
            oval oval:com.redhat.rhsa:tst:20192582005
          • comment pango-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20152116010
    rhsa
    id RHSA-2019:2582
    released 2019-08-29
    severity Important
    title RHSA-2019:2582: pango security update (Important)
  • rhsa
    id RHBA-2019:2824
  • rhsa
    id RHSA-2019:2594
  • rhsa
    id RHSA-2019:3234
rpms
  • pango-0:1.42.4-4.el7_7
  • pango-debuginfo-0:1.42.4-4.el7_7
  • pango-devel-0:1.42.4-4.el7_7
  • pango-tests-0:1.42.4-4.el7_7
  • pango-0:1.42.4-5.el8_0
  • pango-debuginfo-0:1.42.4-5.el8_0
  • pango-debugsource-0:1.42.4-5.el8_0
  • pango-devel-0:1.42.4-5.el8_0
  • pango-tests-debuginfo-0:1.42.4-5.el8_0
  • pango-0:1.42.4-3.el7_6
  • pango-debuginfo-0:1.42.4-3.el7_6
  • pango-devel-0:1.42.4-3.el7_6
  • pango-tests-0:1.42.4-3.el7_6
refmap via4
bugtraq 20190812 [SECURITY] [DSA 4496-1] pango1.0 security update
debian DSA-4496
fedora
  • FEDORA-2019-155e34df5a
  • FEDORA-2019-547be4a683
gentoo GLSA-201909-03
misc
ubuntu USN-4081-1
Last major update 12-04-2022 - 16:51
Published 19-07-2019 - 17:15
Last modified 12-04-2022 - 16:51
Back to Top