Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
Vector
NETWORK
Complexity
MEDIUM
Authentication
NONE
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Pango Pango 1.20 (not an official CPE)
Pango Pango 1.18 (not an official CPE)
Pango Pango 1.16 (not an official CPE)
Pango Pango 1.14 (not an official CPE)
Pango Pango 1.12 (not an official CPE)
Pango Pango 1.10 (not an official CPE)
Pango Pango 1.8 (not an official CPE)
Pango Pango 1.6 (not an official CPE)
Pango Pango 1.4 (not an official CPE)
Pango Pango 1.2 (not an official CPE)
Pango Pango 1.22 (not an official CPE)