Vulnerability Details CVE-2011-3193
Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.04
EPSS Ranking 87.8%
CVSS Severity
CVSS v2 Score 9.3
References
- http://cgit.freedesktop.org/harfbuzz.old/commit/?id=81c8ef785b079980ad5b46be4fe7c7bf156dbf65
- http://cgit.freedesktop.org/harfbuzz/commit/src/harfbuzz-gpos.c?id=da2c52abcd75d46929b34cad55c4fb2c8892bc08
- http://git.gnome.org/browse/pango/commit/pango/opentype/harfbuzz-gpos.c?id=a7a715480db66148b1f487528887508a7991dcd0
- http://lists.opensuse.org/opensuse-updates/2011-10/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2011-10/msg00008.html
- http://rhn.redhat.com/errata/RHSA-2011-1323.html
- http://rhn.redhat.com/errata/RHSA-2011-1324.html
- http://rhn.redhat.com/errata/RHSA-2011-1325.html
- http://rhn.redhat.com/errata/RHSA-2011-1326.html
- http://rhn.redhat.com/errata/RHSA-2011-1327.html
- http://rhn.redhat.com/errata/RHSA-2011-1328.html
- http://secunia.com/advisories/41537
- http://secunia.com/advisories/46117
- http://secunia.com/advisories/46118
- http://secunia.com/advisories/46119
- http://secunia.com/advisories/46128
- http://secunia.com/advisories/46371
- http://secunia.com/advisories/46410
- http://secunia.com/advisories/49895
- http://www.openwall.com/lists/oss-security/2011/08/22/6
- http://www.openwall.com/lists/oss-security/2011/08/24/8
- http://www.openwall.com/lists/oss-security/2011/08/25/1
- http://www.osvdb.org/75652
- http://www.securityfocus.com/bid/49723
- http://www.ubuntu.com/usn/USN-1504-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69991
- https://hermes.opensuse.org/messages/12056605
- https://qt.gitorious.org/qt/qt/commit/9ae6f2f9a57f0c3096d5785913e437953fa6775c
- http://cgit.freedesktop.org/harfbuzz.old/commit/?id=81c8ef785b079980ad5b46be4fe7c7bf156dbf65
- http://cgit.freedesktop.org/harfbuzz/commit/src/harfbuzz-gpos.c?id=da2c52abcd75d46929b34cad55c4fb2c8892bc08
- http://git.gnome.org/browse/pango/commit/pango/opentype/harfbuzz-gpos.c?id=a7a715480db66148b1f487528887508a7991dcd0
- http://lists.opensuse.org/opensuse-updates/2011-10/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2011-10/msg00008.html
- http://rhn.redhat.com/errata/RHSA-2011-1323.html
- http://rhn.redhat.com/errata/RHSA-2011-1324.html
- http://rhn.redhat.com/errata/RHSA-2011-1325.html
- http://rhn.redhat.com/errata/RHSA-2011-1326.html
- http://rhn.redhat.com/errata/RHSA-2011-1327.html
- http://rhn.redhat.com/errata/RHSA-2011-1328.html
- http://secunia.com/advisories/41537
- http://secunia.com/advisories/46117
- http://secunia.com/advisories/46118
- http://secunia.com/advisories/46119
- http://secunia.com/advisories/46128
- http://secunia.com/advisories/46371
- http://secunia.com/advisories/46410
- http://secunia.com/advisories/49895
- http://www.openwall.com/lists/oss-security/2011/08/22/6
- http://www.openwall.com/lists/oss-security/2011/08/24/8
- http://www.openwall.com/lists/oss-security/2011/08/25/1
- http://www.osvdb.org/75652
- http://www.securityfocus.com/bid/49723
- http://www.ubuntu.com/usn/USN-1504-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69991
- https://hermes.opensuse.org/messages/12056605
- https://qt.gitorious.org/qt/qt/commit/9ae6f2f9a57f0c3096d5785913e437953fa6775c
Products affected by CVE-2011-3193
-
cpe:2.3:a:gnome:pango:1.0.0
-
cpe:2.3:a:gnome:pango:1.0.1
-
cpe:2.3:a:gnome:pango:1.0.2
-
cpe:2.3:a:gnome:pango:1.0.3
-
cpe:2.3:a:gnome:pango:1.0.4
-
cpe:2.3:a:gnome:pango:1.0.5
-
cpe:2.3:a:gnome:pango:1.1.0
-
cpe:2.3:a:gnome:pango:1.1.1
-
cpe:2.3:a:gnome:pango:1.1.2
-
cpe:2.3:a:gnome:pango:1.1.3
-
cpe:2.3:a:gnome:pango:1.1.5
-
cpe:2.3:a:gnome:pango:1.10.0
-
cpe:2.3:a:gnome:pango:1.10.1
-
cpe:2.3:a:gnome:pango:1.10.2
-
cpe:2.3:a:gnome:pango:1.10.3
-
cpe:2.3:a:gnome:pango:1.10.4
-
cpe:2.3:a:gnome:pango:1.11.0
-
cpe:2.3:a:gnome:pango:1.11.1
-
cpe:2.3:a:gnome:pango:1.11.3
-
cpe:2.3:a:gnome:pango:1.11.4
-
cpe:2.3:a:gnome:pango:1.11.5
-
cpe:2.3:a:gnome:pango:1.11.6
-
cpe:2.3:a:gnome:pango:1.11.99
-
cpe:2.3:a:gnome:pango:1.12.0
-
cpe:2.3:a:gnome:pango:1.12.1
-
cpe:2.3:a:gnome:pango:1.12.2
-
cpe:2.3:a:gnome:pango:1.12.3
-
cpe:2.3:a:gnome:pango:1.12.4
-
cpe:2.3:a:gnome:pango:1.13.0
-
cpe:2.3:a:gnome:pango:1.13.1
-
cpe:2.3:a:gnome:pango:1.13.2
-
cpe:2.3:a:gnome:pango:1.13.3
-
cpe:2.3:a:gnome:pango:1.13.4
-
cpe:2.3:a:gnome:pango:1.13.5
-
cpe:2.3:a:gnome:pango:1.14.0
-
cpe:2.3:a:gnome:pango:1.14.1
-
cpe:2.3:a:gnome:pango:1.14.10
-
cpe:2.3:a:gnome:pango:1.14.2
-
cpe:2.3:a:gnome:pango:1.14.3
-
cpe:2.3:a:gnome:pango:1.14.4
-
cpe:2.3:a:gnome:pango:1.14.5
-
cpe:2.3:a:gnome:pango:1.14.6
-
cpe:2.3:a:gnome:pango:1.14.7
-
cpe:2.3:a:gnome:pango:1.14.8
-
cpe:2.3:a:gnome:pango:1.14.9
-
cpe:2.3:a:gnome:pango:1.15.0
-
cpe:2.3:a:gnome:pango:1.15.1
-
cpe:2.3:a:gnome:pango:1.15.2
-
cpe:2.3:a:gnome:pango:1.15.3
-
cpe:2.3:a:gnome:pango:1.15.4
-
cpe:2.3:a:gnome:pango:1.15.5
-
cpe:2.3:a:gnome:pango:1.15.6
-
cpe:2.3:a:gnome:pango:1.16.0
-
cpe:2.3:a:gnome:pango:1.16.1
-
cpe:2.3:a:gnome:pango:1.16.2
-
cpe:2.3:a:gnome:pango:1.16.3
-
cpe:2.3:a:gnome:pango:1.16.4
-
cpe:2.3:a:gnome:pango:1.16.5
-
cpe:2.3:a:gnome:pango:1.17.0
-
cpe:2.3:a:gnome:pango:1.17.1
-
cpe:2.3:a:gnome:pango:1.17.2
-
cpe:2.3:a:gnome:pango:1.17.3
-
cpe:2.3:a:gnome:pango:1.17.5
-
cpe:2.3:a:gnome:pango:1.18.0
-
cpe:2.3:a:gnome:pango:1.18.1
-
cpe:2.3:a:gnome:pango:1.18.2
-
cpe:2.3:a:gnome:pango:1.18.3
-
cpe:2.3:a:gnome:pango:1.18.4
-
cpe:2.3:a:gnome:pango:1.19.1
-
cpe:2.3:a:gnome:pango:1.19.2
-
cpe:2.3:a:gnome:pango:1.19.3
-
cpe:2.3:a:gnome:pango:1.19.4
-
cpe:2.3:a:gnome:pango:1.2.0
-
cpe:2.3:a:gnome:pango:1.2.1
-
cpe:2.3:a:gnome:pango:1.2.2
-
cpe:2.3:a:gnome:pango:1.2.3
-
cpe:2.3:a:gnome:pango:1.2.4
-
cpe:2.3:a:gnome:pango:1.20.0
-
cpe:2.3:a:gnome:pango:1.20.1
-
cpe:2.3:a:gnome:pango:1.20.2
-
cpe:2.3:a:gnome:pango:1.20.3
-
cpe:2.3:a:gnome:pango:1.20.4
-
cpe:2.3:a:gnome:pango:1.20.5
-
cpe:2.3:a:gnome:pango:1.21.0
-
cpe:2.3:a:gnome:pango:1.21.1
-
cpe:2.3:a:gnome:pango:1.21.2
-
cpe:2.3:a:gnome:pango:1.21.3
-
cpe:2.3:a:gnome:pango:1.21.5
-
cpe:2.3:a:gnome:pango:1.21.6
-
cpe:2.3:a:gnome:pango:1.22.0
-
cpe:2.3:a:gnome:pango:1.22.2
-
cpe:2.3:a:gnome:pango:1.22.3
-
cpe:2.3:a:gnome:pango:1.22.4
-
cpe:2.3:a:gnome:pango:1.23.0
-
cpe:2.3:a:gnome:pango:1.24.0
-
cpe:2.3:a:gnome:pango:1.24.1
-
cpe:2.3:a:gnome:pango:1.24.2
-
cpe:2.3:a:gnome:pango:1.24.3
-
cpe:2.3:a:gnome:pango:1.24.4
-
cpe:2.3:a:gnome:pango:1.24.5
-
cpe:2.3:a:gnome:pango:1.3.0
-
cpe:2.3:a:gnome:pango:1.3.1
-
cpe:2.3:a:gnome:pango:1.3.2
-
cpe:2.3:a:gnome:pango:1.3.3
-
cpe:2.3:a:gnome:pango:1.3.5
-
cpe:2.3:a:gnome:pango:1.3.6
-
cpe:2.3:a:gnome:pango:1.4.0
-
cpe:2.3:a:gnome:pango:1.4.1
-
cpe:2.3:a:gnome:pango:1.5.0
-
cpe:2.3:a:gnome:pango:1.5.1
-
cpe:2.3:a:gnome:pango:1.5.2
-
cpe:2.3:a:gnome:pango:1.6.0
-
cpe:2.3:a:gnome:pango:1.7.0
-
cpe:2.3:a:gnome:pango:1.8.0
-
cpe:2.3:a:gnome:pango:1.8.1
-
cpe:2.3:a:gnome:pango:1.8.2
-
cpe:2.3:a:gnome:pango:1.9.0
-
cpe:2.3:a:gnome:pango:1.9.1
-
cpe:2.3:a:qt:qt:1.41
-
cpe:2.3:a:qt:qt:1.42
-
cpe:2.3:a:qt:qt:1.43
-
cpe:2.3:a:qt:qt:1.44
-
cpe:2.3:a:qt:qt:1.45
-
cpe:2.3:a:qt:qt:2.0.0
-
cpe:2.3:a:qt:qt:2.0.1
-
cpe:2.3:a:qt:qt:2.0.2
-
cpe:2.3:a:qt:qt:2.00
-
cpe:2.3:a:qt:qt:2.1.0
-
cpe:2.3:a:qt:qt:2.1.1
-
cpe:2.3:a:qt:qt:2.2.0
-
cpe:2.3:a:qt:qt:2.2.1
-
cpe:2.3:a:qt:qt:2.2.2
-
cpe:2.3:a:qt:qt:2.2.3
-
cpe:2.3:a:qt:qt:2.2.4
-
cpe:2.3:a:qt:qt:2.3.0
-
cpe:2.3:a:qt:qt:2.3.1
-
cpe:2.3:a:qt:qt:2.3.10
-
cpe:2.3:a:qt:qt:2.3.2
-
cpe:2.3:a:qt:qt:2.3.4
-
cpe:2.3:a:qt:qt:2.3.5
-
cpe:2.3:a:qt:qt:2.3.6
-
cpe:2.3:a:qt:qt:2.3.7
-
cpe:2.3:a:qt:qt:2.3.8
-
cpe:2.3:a:qt:qt:3.0.0
-
cpe:2.3:a:qt:qt:3.0.1
-
cpe:2.3:a:qt:qt:3.0.2
-
cpe:2.3:a:qt:qt:3.0.3
-
cpe:2.3:a:qt:qt:3.0.4
-
cpe:2.3:a:qt:qt:3.0.5
-
cpe:2.3:a:qt:qt:3.0.6
-
cpe:2.3:a:qt:qt:3.0.7
-
cpe:2.3:a:qt:qt:3.1.0
-
cpe:2.3:a:qt:qt:3.1.1
-
cpe:2.3:a:qt:qt:3.1.2
-
cpe:2.3:a:qt:qt:3.2.0
-
cpe:2.3:a:qt:qt:3.2.1
-
cpe:2.3:a:qt:qt:3.2.2
-
cpe:2.3:a:qt:qt:3.2.3
-
cpe:2.3:a:qt:qt:3.3.0
-
cpe:2.3:a:qt:qt:3.3.1
-
cpe:2.3:a:qt:qt:3.3.2
-
cpe:2.3:a:qt:qt:3.3.3
-
cpe:2.3:a:qt:qt:3.3.4
-
cpe:2.3:a:qt:qt:3.3.5
-
cpe:2.3:a:qt:qt:3.3.6
-
cpe:2.3:a:qt:qt:3.3.7
-
cpe:2.3:a:qt:qt:3.3.8
-
cpe:2.3:a:qt:qt:3.3.8b
-
cpe:2.3:a:qt:qt:4.0.0
-
cpe:2.3:a:qt:qt:4.0.1
-
cpe:2.3:a:qt:qt:4.1.0
-
cpe:2.3:a:qt:qt:4.1.1
-
cpe:2.3:a:qt:qt:4.1.2
-
cpe:2.3:a:qt:qt:4.1.3
-
cpe:2.3:a:qt:qt:4.1.4
-
cpe:2.3:a:qt:qt:4.1.5
-
cpe:2.3:a:qt:qt:4.2.0
-
cpe:2.3:a:qt:qt:4.2.1
-
cpe:2.3:a:qt:qt:4.2.2
-
cpe:2.3:a:qt:qt:4.2.3
-
cpe:2.3:a:qt:qt:4.3.0
-
cpe:2.3:a:qt:qt:4.3.1
-
cpe:2.3:a:qt:qt:4.3.2
-
cpe:2.3:a:qt:qt:4.3.3
-
cpe:2.3:a:qt:qt:4.3.4
-
cpe:2.3:a:qt:qt:4.3.5
-
cpe:2.3:a:qt:qt:4.4.0
-
cpe:2.3:a:qt:qt:4.4.1
-
cpe:2.3:a:qt:qt:4.4.2
-
cpe:2.3:a:qt:qt:4.4.3
-
cpe:2.3:a:qt:qt:4.5.0
-
cpe:2.3:a:qt:qt:4.5.1
-
cpe:2.3:a:qt:qt:4.5.2
-
cpe:2.3:a:qt:qt:4.5.3
-
cpe:2.3:a:qt:qt:4.6.0
-
cpe:2.3:a:qt:qt:4.6.1
-
cpe:2.3:a:qt:qt:4.6.2
-
cpe:2.3:a:qt:qt:4.6.3
-
cpe:2.3:a:qt:qt:4.6.4
-
cpe:2.3:a:qt:qt:4.6.5
-
cpe:2.3:a:qt:qt:4.7.0
-
cpe:2.3:a:qt:qt:4.7.1
-
cpe:2.3:a:qt:qt:4.7.2
-
cpe:2.3:a:qt:qt:4.7.3
-
cpe:2.3:o:canonical:ubuntu_linux:10.04
-
cpe:2.3:o:canonical:ubuntu_linux:11.04
-
cpe:2.3:o:opensuse:opensuse:11.3
-
cpe:2.3:o:opensuse:opensuse:11.4
-
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0
-
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0
-
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
-
cpe:2.3:o:redhat:enterprise_linux_eus:6.1
-
cpe:2.3:o:redhat:enterprise_linux_server:4.0
-
cpe:2.3:o:redhat:enterprise_linux_server:5.0
-
cpe:2.3:o:redhat:enterprise_linux_server:6.0
-
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0
-
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0
-
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0