Description
Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pango1.0 | 1.26.2-1 | — |
| Debian 13 | pango1.0 | 1.26.2-1 | — |
| Debian 12 | pango1.0 | 1.26.2-1 | — |
| Debian 5.0 | pango1.0 | 1.20.5-5+lenny1 | DSA-2019-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | pango +1 | 1.14.9-8.el5 | RHSA-2010:0140 |
| RHEL 4 | evolution28-pango +1 | 1.14.9-13.el4_8 | RHSA-2010:0140 |
| RHEL 4 | pango +1 | 1.6.0-16.el4_8 | RHSA-2010:0140 |
| RHEL 3 | pango +1 | 1.2.5-10 | RHSA-2010:0140 |
Advisories 2
- RHSA-2010:0140 Red Hat Security Advisory: pango security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2019-1 pango1.0 - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2010:121 vendor-advisory
- ADV-2010-1552 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=555831
- oval:org.mitre.oval:def:9417 vdb-entry signature
- http://ftp.gnome.org/pub/GNOME/sources/pango/1.27/pango-1.27.1.tar.bz2
- 39041 third-party-advisory
- DSA-2019 vendor-advisory
- RHSA-2010:0140 vendor-advisory
- SUSE-SR:2010:013 vendor-advisory
- ADV-2010-0661 vdb-entry
- SUSE-SR:2010:009 vendor-advisory
- SUSE-SR:2010:012 vendor-advisory
- 38760 vdb-entry
- ADV-2010-0627 vdb-entry
- 1023711 vdb-entry