CVE-2009-1194
pango1.0 - arbitrary code execution
EPSS 4.9%
Description
Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
How to fix CVE-2009-1194
To remediate CVE-2009-1194, upgrade the affected package to a fixed version below.
- Debian/pango1.0—upgrade to 1.24.0-2 or later
- Debian/pango1.0—upgrade to 1.14.8-5+etch1 or later
Is CVE-2009-1194 being exploited?
Low — EPSS is 4.9%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 1.24.0-2
- from 0, < 1.14.8-5+etch1