The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade fribidi | Nov 27, 2019 | Nov 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade fribidiUpgrade fribidi-develUpgrade fribidi-debuginfo | Jun 4, 2020 | Nov 13, 2019 |
| Centos_linux | — | Upgrade fribidi-debuginfoUpgrade fribidiUpgrade fribidi-develUpgrade fribidi-debugsource | Dec 23, 2019 | Nov 13, 2019 |
| Debian | — | Upgrade fribidi | Nov 11, 2019 | Nov 11, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/fribidi. | Mar 20, 2020 | Nov 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade fribidiUpgrade fribidi-devel | Feb 26, 2020 | Nov 13, 2019 |
| Oracle_linux | — | Upgrade fribidi-develUpgrade fribidi | Dec 20, 2019 | Nov 7, 2019 |
| Redhat_linux | — | Upgrade fribidi-debuginfoUpgrade fribidiUpgrade fribidi-develUpgrade fribidi-debugsource | Dec 20, 2019 | Nov 13, 2019 |
| Suse | — | Upgrade libfribidi0Upgrade fribidiUpgrade libfribidi0-32bitUpgrade fribidi-devel | May 26, 2021 | Nov 7, 2019 |
| Ubuntu | — | Upgrade libfribidi0 | Nov 8, 2019 | Nov 7, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub