CVE-2011-0020 Memory corruption in n/a

High 7.6 Published 24 Jan 2011 Updated 6 Aug 2024

A heap-based buffer overflow in Pango allows remote attackers to execute arbitrary code or cause a crash via a crafted font file when the FreeType2 backend is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2011-0020?

CVE-2011-0020 is a high-severity memory corruption vulnerability in n/a, published on 24 Jan 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.

Weakness: CWE-119

Which versions are affected by CVE-2011-0020?

It affects 2 products.

Linux distribution packages (27)

`evolution28-pango` Red Hat:enterprise_linux:4::as	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-devel` Red Hat:enterprise_linux:4::as	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango` Red Hat:enterprise_linux:4::es	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-devel` Red Hat:enterprise_linux:4::es	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango` Red Hat:enterprise_linux:4::ws	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:1.14.9-13.el4_10`
`evolution28-pango-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:1.14.9-13.el4_10`
`pango` Red Hat:enterprise_linux:5::server	All versions	`0:1.14.9-8.el5_6.2`
`pango-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.14.9-8.el5_6.2`
`pango-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.14.9-8.el5_6.2`
`pango` Red Hat:enterprise_linux:6::client	All versions	`0:1.28.1-3.el6_0.3`
`pango-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:1.28.1-3.el6_0.3`
`pango-devel` Red Hat:enterprise_linux:6::client	All versions	`0:1.28.1-3.el6_0.3`
`pango` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.28.1-3.el6_0.3`
`pango-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.28.1-3.el6_0.3`
`pango-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.28.1-3.el6_0.3`
`pango` Red Hat:enterprise_linux:6::server	All versions	`0:1.28.1-3.el6_0.3`
`pango-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:1.28.1-3.el6_0.3`
`pango-devel` Red Hat:enterprise_linux:6::server	All versions	`0:1.28.1-3.el6_0.3`
`pango` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.28.1-3.el6_0.3`
`pango-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.28.1-3.el6_0.3`
`pango-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.28.1-3.el6_0.3`

Products include Gnome Pango, Pango Pango.

How do I fix CVE-2011-0020?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2011-0020 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-0020 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as DEBIAN-CVE-2011-0020, GHSA-5c8w-jg4w-gcj2, RHSA-2011:0180.