Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pango-develUpgrade pango | Dec 1, 2016 | May 11, 2009 |
| Debian | — | Upgrade pango1.0 | Jul 30, 2024 | May 11, 2009 |
| Freebsd | — | Upgrade linux-pangoUpgrade linux-f8-pangoUpgrade pangoUpgrade linux-f10-pango | Dec 10, 2025 | May 13, 2009 |
| Gentoo Linux | — | Upgrade x11-libs/pango. | Oct 30, 2017 | May 11, 2009 |
| Mfsa2009 36 | — | Upgrade to Mozilla Firefox version 3.5Upgrade to Mozilla Firefox version 3.0.12 | Jun 14, 2012 | May 11, 2009 |
| Oracle_linux | — | Upgrade pangoUpgrade pango-devel | Oct 16, 2024 | May 11, 2009 |
| Suse | — | Upgrade orbit2Upgrade gconf2-32bitUpgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner191Upgrade libfreebl3-x86Upgrade MozillaFirefox-branding-SLEDUpgrade pangoUpgrade libidl-x86Upgrade mozilla-xulrunner191-32bitUpgrade pango-docUpgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade gconf2Upgrade orbit2-x86Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-nss-x86Upgrade gconf2-x86Upgrade mozilla-xulrunner191-translationsUpgrade libidl-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner192Upgrade libfreebl3Upgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-nsprUpgrade pango-x86Upgrade mozilla-xulrunner191-x86Upgrade orbit2-32bitUpgrade mozilla-xulrunner192-32bitUpgrade MozillaFirefoxUpgrade pango-32bitUpgrade mozilla-xulrunner190-x86Upgrade libidlUpgrade mozilla-nspr-x86Upgrade mozilla-nspr-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpango1.0-0 | Nov 8, 2024 | May 11, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub