Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qt4-mysqlUpgrade evolution28-pango-develUpgrade qt4-postgresqlUpgrade evolution28-pangoUpgrade qt4-develUpgrade pango-develUpgrade qt4-docUpgrade qt4-odbcUpgrade fryskUpgrade pangoUpgrade qt4-sqliteUpgrade qt4 | Dec 1, 2016 | Jun 15, 2012 |
| Debian | — | Upgrade pango1.0 | Jul 30, 2024 | Jun 16, 2012 |
| Gentoo Linux | — | Upgrade dev-qt/qtgui.Upgrade dev-qt/qtcore. | Oct 30, 2017 | Jun 15, 2012 |
| Oracle_linux | — | Upgrade pango-develUpgrade pango | Oct 16, 2024 | Jun 16, 2012 |
| Suse | — | Upgrade libqt4-sql-32bitUpgrade libqt4-qt3supportUpgrade libQtWebKit4-x86Upgrade libqt4-sql-postgresql-32bitUpgrade libQtWebKit4-32bitUpgrade libqt4-sql-unixODBCUpgrade libqt4-sql-sqlite-32bitUpgrade libqt4-x11-x86Upgrade qt4-x11-toolsUpgrade libqt4-32bitUpgrade libqt4-qt3support-x86Upgrade libqt4-sql-mysql-32bitUpgrade libqt4-develUpgrade libqt4-sql-mysql-x86Upgrade libqt4-sql-postgresqlUpgrade libqt4Upgrade libQtWebKit4Upgrade libqt4-sql-postgresql-x86Upgrade libqt4-sql-mysqlUpgrade libqt4-sqlUpgrade libqt4-sql-x86Upgrade libqt4-x11Upgrade libqt4-linguistUpgrade libqt4-qt3support-32bitUpgrade libqt4-sql-unixODBC-32bitUpgrade libQtWebKit-develUpgrade libqt4-devel-docUpgrade libqt4-sql-sqlite-x86Upgrade libqt4-x11-32bitUpgrade libqt4-private-headers-develUpgrade libqt4-sql-sqliteUpgrade libqt4-devel-doc-dataUpgrade libqt4-sql-unixODBC-x86Upgrade libqt4-x86 | Dec 12, 2013 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libqtgui4Upgrade libqt4-network | Nov 8, 2024 | Jun 16, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub