Description
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gnome | Pango | 1.42 and later | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pango1.0 | 1.42.4-7 | — |
| Debian 13 | pango1.0 | 1.42.4-7 | — |
| Debian 12 | pango1.0 | 1.42.4-7 | — |
| Debian 10 | pango1.0 | 1.42.4-7~deb10u1 | DSA-4496-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | pango +1 | 1.42.4-5.el8_0 | RHSA-2019:2582 |
| RHEL 7 | pango +2 | 1.42.4-4.el7_7 | RHSA-2019:2571 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.6 EUS | pango +2 | 1.42.4-3.el7_6 | RHSA-2019:3234 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | pango | 1.44.1-r0 | — |
| Alpine v3.23 | pango | 1.44.1-r0 | — |
| Alpine v3.22 | pango | 1.44.1-r0 | — |
| Alpine v3.21 | pango | 1.44.1-r0 | — |
| Alpine v3.20 | pango | 1.44.1-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | pango | 1.44.1-r0 | — |
| Alpine v3.18 | pango | 1.44.1-r0 | — |
| Alpine v3.17 | pango | 1.44.1-r0 | — |
| Alpine v3.16 | pango | 1.44.1-r0 | — |
| Alpine v3.15 | pango | 1.44.1-r0 | — |
| Alpine v3.14 | pango | 1.44.1-r0 | — |
| Alpine v3.13 | pango | 1.44.1-r0 | — |
| Alpine v3.12 | pango | 1.44.1-r0 | — |
| Alpine v3.11 | pango | 1.44.1-r0 | — |
| Alpine v3.10 | pango | 1.42.4-r2 | — |
| Alpine v3.9 | pango | 1.42.4-r1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | pango | 1.44-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | pango +1 | 1.42.4-5.el8_0 | ELSA-2019-2582 |
| Oracle Linux 7 | pango +2 | 1.42.4-4.el7_7 | ELSA-2019-2571 |
Advisories 6
- RHSA-2019:3234 Red Hat Security Advisory: pango security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2019:2571 Red Hat Security Advisory: pango security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4496-1 pango1.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2019:2582 Red Hat Security Advisory: pango security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2019-2582 Important: pango security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 29, 2019
- ELSA-2019-2571 Important: pango security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 27, 2019
References
- USN-4081-1 vendor-advisory
- DSA-4496 vendor-advisory
- 20190812 [SECURITY] [DSA 4496-1] pango1.0 security update mailing-list
- FEDORA-2019-547be4a683 vendor-advisory
- RHSA-2019:2571 vendor-advisory
- RHSA-2019:2582 vendor-advisory
- FEDORA-2019-155e34df5a vendor-advisory
- GLSA-201909-03 vendor-advisory
- RHSA-2019:2594 vendor-advisory
- RHBA-2019:2824 vendor-advisory
- RHSA-2019:3234 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://gitlab.gnome.org/GNOME/pango/-/commits/main/pango/pango-bidi-type.c
- https://gitlab.gnome.org/GNOME/pango/-/issues/342