Pango is a library for laying out and rendering text, with an emphasis on internationalization. Pango suffers from a multiplicative integer overflow which may lead to a potentially exploitable, heap overflow depending on the calling conditions.
For example, this vulnerability is remotely reachable in Firefox by creating an overly large document.location value but only results in a process-terminating, allocation error (denial of service).
Vulnerable Systems:
* Pango versions prior to 1.24
Patch Availability:
* Pango version 1.24 or newer
The affected function is pango_glyph_string_set_size. An overflow check when doubling the size neglects the overflow possible on the subsequent allocation:
Disclosure Timeline:
2009-02-22: attempted to contact upstream via gtk-i18n-list@gnome.org 2009-02-25: bug filed with Mozilla against firefox 2009-03-02: Behdad Esfahbod patched Pango upstream for 1.24 2009-04-13: vendor-sec alerted regarding backporting the silent pango fix 2009-04-23: embargo date and CVE assigned (thanks Josh Bressers!) 2009-05-07: advisory released
