What’s Vulnerable › Vulnerabilities
CVE-2019-1010238
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-07-19 · updated 2026-06-17
- Weakness: CWE-787
Description
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
Affected products
- Canonical Ubuntu Linux: 19.04
- Debian Linux: 10.0
- Fedoraproject Fedora: 29, 30
- Gnome Pango: from 1.42.0 through 1.44
- Oracle Corporation SD-WAN Edge: 7.3, 8.0, 8.1, 8.2
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Eus: 7.4, 7.6, 8.1, 8.2, 8.4
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.6, 7.7, 8.2, 8.4
- RedHat Enterprise Linux Server Tus: 7.6, 7.7, 8.2, 8.4
- RedHat Enterprise Linux Workstation: 7.0
- Red Hat OpenShift Container Platform 4.18: 3.11, 4.1
References
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2571
- https://access.redhat.com/errata/RHSA-2019:2582
- https://access.redhat.com/errata/RHSA-2019:2594
- https://access.redhat.com/errata/RHSA-2019:3234
- https://gitlab.gnome.org/GNOME/pango/-/commits/main/pango/pango-bidi-type.c
- https://gitlab.gnome.org/GNOME/pango/-/issues/342
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D6HWAHXJ2ZXINYMANHPFDDCJFWUQ57M4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFFF4FY7SCAYT3EKTYPGRN6BVKZTH7Y7/
- https://seclists.org/bugtraq/2019/Aug/14
- https://security.gentoo.org/glsa/201909-03
- https://usn.ubuntu.com/4081-1/
Get alerted when CVE-2019-1010238 or the next vulnerability affects your stack