| Package | Affected versions | Patched versions |
|---|---|---|
| pango | = 1.28.0= 1.28.1= 1.28.2≤ 1.28.3 | |
| pango | = 0.20= 0.21= 0.22= 0.23= 0.24= 0.25= 0.26= 1.0= 1.1= 1.10= 1.11= 1.12= 1.13= 1.14= 1.15= 1.16= 1.17= 1.18= 1.19= 1.2= 1.20= 1.21= 1.22= 1.23= 1.24= 1.25= 1.26= 1.27= 1.3= 1.4= 1.5= 1.6= 1.7= 1.8= 1.9 |
Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free