Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 7 May 2009 12:42:27 -0500
From: Will Drewry <>
Subject: [oCERT-2009-001] Pango integer overflow in heap allocation size 

#2009-001 Pango integer overflow in heap allocation size calculations


Pango is a library for laying out and rendering text, with an emphasis
on internationalization.  Pango suffers from a multiplicative integer
overflow which may lead to a potentially exploitable, heap overflow
depending on the calling conditions.  For example, this vulnerability is
remotely reachable in Firefox by creating an overly large
document.location value but only results in a process-terminating,
allocation error (denial of service).

The affected function is pango_glyph_string_set_size. An overflow check
when doubling the size neglects the overflow possible on the subsequent

  string->glyphs = g_realloc (string->glyphs, string->space *
                              sizeof (PangoGlyphInfo));

Note that other font rendering subsystems suffer from similar issues and
should be cross-checked by maintainers.

Affected version:

Pango < 1.24

Fixed version:

Pango >= 1.24
(check with your package maintainer for backports)

Credit: Will Drewry, oCERT Team | Google Security Team.
        Special thanks to Karl Tomlinson for extended analysis of the
        impact on Firefox.

CVE: CVE-2009-1194

2009-02-22: attempted to contact upstream via
2009-02-25: bug filed with Mozilla against firefox
2009-03-02: Behdad Esfahbod patched Pango upstream for 1.24
2009-04-13: vendor-sec alerted regarding backporting the silent pango fix
2009-04-23: embargo date and CVE assigned (thanks Josh Bressers!)
2009-05-07: advisory released




Will Drewry <>
oCERT Team ::

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.