Description
Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pango1.0 | 1.24.0-2 | — |
| Debian 13 | pango1.0 | 1.24.0-2 | — |
| Debian 12 | pango1.0 | 1.24.0-2 | — |
| Debian 5.0 | pango1.0 | 1.20.5-3+lenny1 | DSA-1798-1 |
| Debian 4.0 | pango1.0 | 1.14.8-5+etch1 | DSA-1798-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | pango +1 | 1.14.9-5.el5_3 | RHSA-2009:0476 |
| RHEL 4 | evolution28-pango +1 | 1.14.9-11.el4_7 | RHSA-2009:0476 |
| RHEL 4 | pango +1 | 1.6.0-14.4_7 | RHSA-2009:0476 |
| RHEL 3 | pango +1 | 1.2.5-8 | RHSA-2009:0476 |
Advisories 2
- RHSA-2009:0476 Red Hat Security Advisory: pango security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1798-1 pango1.0 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35038 third-party-advisory
- DSA-1798 vendor-advisory
- http://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e
- RHSA-2009:0476 vendor-advisory
- 36145 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=480134
- http://www.ocert.org/advisories/ocert-2009-001.html
- 35018 third-party-advisory
- 35021 third-party-advisory
- 34870 vdb-entry
- 1022196 vdb-entry
- 54279 vdb-entry
- SUSE-SA:2009:039 vendor-advisory
- [oss-security] 20090507 [oCERT-2009-001] Pango integer overflow in heap allocation size calculations mailing-list
- ADV-2009-1269 vdb-entry
- 35758 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=496887
- 36005 third-party-advisory
- https://launchpad.net/bugs/cve/2009-1194
- 35685 third-party-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-36.html
- USN-773-1 vendor-advisory
- SUSE-SA:2009:042 vendor-advisory
- SUSE-SR:2009:012 vendor-advisory
- oval:org.mitre.oval:def:10137 vdb-entry signature
- 35914 third-party-advisory
- ADV-2009-1972 vdb-entry
- 35027 third-party-advisory
- 20090507 [oCERT-2009-001] Pango integer overflow in heap allocation size calculations mailing-list
- pango-pangoglyphstringsetsize-bo(50397) vdb-entry
- 264308 vendor-advisory