{"id":"CVE-2019-1010238","details":"Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.","modified":"2026-08-14T03:51:50.258468951Z","published":"2019-07-19T17:15:11.690Z","database_specific":{"unresolved_ranges":[{"vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"19.04"},{"last_affected":"19.04"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"29"},{"last_affected":"29"},{"introduced":"30"},{"last_affected":"30"}]},{"source":"CPE_STRING","vendor_product":"oracle:sd-wan_edge","cpes":["cpe:2.3:a:oracle:sd-wan_edge:7.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:sd-wan_edge:8.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:sd-wan_edge:8.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3"},{"last_affected":"7.3"},{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"}]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_desktop"},{"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.6"},{"last_affected":"7.6"},{"introduced":"8.1"},{"last_affected":"8.1"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_eus","cpes":["cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6"},{"last_affected":"7.6"},{"introduced":"7.7"},{"last_affected":"7.7"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus"},{"extracted_events":[{"introduced":"7.6"},{"last_affected":"7.6"},{"introduced":"7.7"},{"last_affected":"7.7"},{"introduced":"8.2"},{"last_affected":"8.2"},{"introduced":"8.4"},{"last_affected":"8.4"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_workstation"},{"vendor_product":"redhat:openshift_container_platform","cpes":["cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.11"},{"last_affected":"3.11"},{"introduced":"4.1"},{"last_affected":"4.1"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D6HWAHXJ2ZXINYMANHPFDDCJFWUQ57M4/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFFF4FY7SCAYT3EKTYPGRN6BVKZTH7Y7/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2019:2824"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2582"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2594"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3234"},{"type":"ADVISORY","url":"https://seclists.org/bugtraq/2019/Aug/14"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201909-03"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4081-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4496"},{"type":"REPORT","url":"https://gitlab.gnome.org/GNOME/pango/-/issues/342"},{"type":"FIX","url":"https://gitlab.gnome.org/GNOME/pango/-/commits/main/pango/pango-bidi-type.c"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gnome/pango","events":[{"introduced":"d4f3370336a40907f528a41e75a55fe4f50c1a11"},{"last_affected":"9a79369d764b0274b6cd7ffb43391d9de0ad3832"}],"database_specific":{"cpe":"cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.42.0"},{"last_affected":"1.44"}],"source":"CPE_RANGE"}}],"versions":["1.44","1.43.0","1.42.4","1.42.3","1.42.2","1.42.1","1.42.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-1010238.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}