Strix
26.1K

CVE-2019-1010238

CRITICALCVSS 9.8/10EPSS 6.27%

Last modified

CVE-2019-1010238 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. EPSS estimates a 6.27% chance of exploitation in the next 30 days.

Description

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
6.27%

92.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GnomePango>= 1.42.0, <= 1.44
OracleSd-Wan Edge7.3
OracleSd-Wan Edge8.0
OracleSd-Wan Edge8.1
OracleSd-Wan Edge8.2
FedoraprojectFedora29
FedoraprojectFedora30
DebianDebian Linux10.0
CanonicalUbuntu Linux19.04
RedhatOpenshift Container Platform3.11
RedhatOpenshift Container Platform4.1
RedhatEnterprise Linux8.0
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux Eus7.4
RedhatEnterprise Linux Eus7.6
RedhatEnterprise Linux Eus8.1
RedhatEnterprise Linux Eus8.2
RedhatEnterprise Linux Eus8.4
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Server Aus7.6
RedhatEnterprise Linux Server Aus7.7
RedhatEnterprise Linux Server Aus8.2
RedhatEnterprise Linux Server Aus8.4
RedhatEnterprise Linux Server Tus7.6
RedhatEnterprise Linux Server Tus7.7
RedhatEnterprise Linux Server Tus8.2
RedhatEnterprise Linux Server Tus8.4
RedhatEnterprise Linux Workstation7.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-1010238?
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
How severe is CVE-2019-1010238?
CVE-2019-1010238 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 6.27% probability of exploitation in the next 30 days.
How do I fix CVE-2019-1010238?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2019

View all 2019CVEs →

Are you affected by CVE-2019-1010238?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST