This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201909-03">
<title>Pango: Buffer overflow</title>
<synopsis>A buffer overflow in Pango might allow an attacker to execute
arbitrary code.
</synopsis>
<producttype="ebuild">pango</product>
<announced>2019-09-06</announced>
<revisedcount="1">2019-09-06</revised>
<bug>692110</bug>
<access>remote</access>
<affected>
<packagename="x11-libs/pango"auto="yes"arch="*">
<unaffectedrange="ge">1.42.4-r2</unaffected>
<vulnerablerange="lt">1.42.4-r2</vulnerable>
</package>
</affected>
<background>
<p>Pango is a library for layout and rendering of internationalized text.</p>
</background>
<description>
<p>A buffer overflow has been discovered in Pango’s
pango_log2vis_get_embedding_levels function.
</p>
</description>
<impacttype="normal">
<p>A remote attacker could entice a user to process a specially crafted
string with functions like pango_itemize, possibly resulting in execution
of arbitrary code with the privileges of the process or a Denial of
Service condition.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All Pango users should upgrade to the latest version:</p>