Gnome Pango vulnerabilities

6 CVEs affecting Gnome Pango, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-1010238, published 2019-07-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-0020, published 2011-01-24. High severity, CVSS 7.6. EPSS: 18.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows…
CVE-2018-15120, published 2018-08-24. Medium severity, CVSS 6.5. EPSS: 11.5% chance of exploitation in the next 30 days. libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via…
CVE-2011-3193, published 2012-06-16. High severity, CVSS 9.3. EPSS: 7.3% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service…
CVE-2019-1010238, published 2019-07-19. Critical severity, CVSS 9.8. EPSS: 6.3% chance of exploitation in the next 30 days. Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name:…
CVE-2011-0064, published 2011-03-07. Medium severity, CVSS 6.8. EPSS: 3.3% chance of exploitation in the next 30 days. The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to…
CVE-2010-0421, published 2010-03-18. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service…