CVE-2011-0064 Null dereference in n/a
Remote attackers can cause denial of service or execute arbitrary code via crafted OpenType font data due to unchecked memory reallocation failures in HarfBuzz.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-0064?
CVE-2011-0064 is a medium-severity vulnerability in Mozilla Firefox, published on 7 Mar 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
Which versions are affected by CVE-2011-0064?
It affects 2 products.
Linux distribution packages (12)
pango Red Hat:enterprise_linux:6::client | All versions | 0:1.28.1-3.el6_0.5 |
pango-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:1.28.1-3.el6_0.5 |
pango-devel Red Hat:enterprise_linux:6::client | All versions | 0:1.28.1-3.el6_0.5 |
pango Red Hat:enterprise_linux:6::computenode | All versions | 0:1.28.1-3.el6_0.5 |
pango-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:1.28.1-3.el6_0.5 |
pango-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:1.28.1-3.el6_0.5 |
pango Red Hat:enterprise_linux:6::server | All versions | 0:1.28.1-3.el6_0.5 |
pango-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:1.28.1-3.el6_0.5 |
pango-devel Red Hat:enterprise_linux:6::server | All versions | 0:1.28.1-3.el6_0.5 |
pango Red Hat:enterprise_linux:6::workstation | All versions | 0:1.28.1-3.el6_0.5 |
pango-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:1.28.1-3.el6_0.5 |
pango-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:1.28.1-3.el6_0.5 |
Products include Gnome Pango, Mozilla Firefox.
How do I fix CVE-2011-0064?
Upgrade to a fixed version.
Is CVE-2011-0064 being exploited?
There is no known exploitation of CVE-2011-0064 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2011-0064, DSA-2178-1, GHSA-49v5-wqh2-vj5q, RHSA-2011:0309.