Description
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pango1.0 | 1.28.3-2~sid1 | — |
| Debian 13 | pango1.0 | 1.28.3-2~sid1 | — |
| Debian 12 | pango1.0 | 1.28.3-2~sid1 | — |
| Debian 6.0 | pango1.0 | 1.28.3-1+squeeze2 | DSA-2178-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | pango +1 | 1.28.1-3.el6_0.5 | RHSA-2011:0309 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pango | 1.40.3-1.1 | openSUSE-SU-2024:10578-1 |
Advisories 3
- RHSA-2011:0309 Red Hat Security Advisory: pango security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2178-1 pango1.0 - NULL pointer dereference Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10578-1 libpango-1_0-0-1.40.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-1082-1 vendor-advisory
- 43578 third-party-advisory
- http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9
- https://bugzilla.novell.com/show_bug.cgi?id=672502
- MDVSA-2011:040 vendor-advisory
- ADV-2011-0543 vdb-entry
- ADV-2011-0555 vdb-entry
- SUSE-SR:2011:005 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=678563
- ADV-2011-0558 vdb-entry
- 43800 third-party-advisory
- pango-hbbufferensure-bo(65770) vdb-entry
- https://build.opensuse.org/request/show/63070
- ADV-2011-0683 vdb-entry
- 1025145 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=606997
- FEDORA-2011-3194 vendor-advisory
- 43559 third-party-advisory
- 43572 third-party-advisory
- ADV-2011-0584 vdb-entry
- 46632 vdb-entry
- RHSA-2011:0309 vendor-advisory
- DSA-2178 vendor-advisory