CVE-2019-1010238

Name	CVE-2019-1010238
Description	Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4496-1
Debian Bugs	933860

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pango1.0 (PTS)	bullseye	1.46.2-3	fixed
	bookworm	1.50.12+ds-1	fixed
	trixie	1.56.3-1	fixed
	forky, sid	1.56.3-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
pango1.0	source	jessie	(not affected)
pango1.0	source	stretch	(not affected)
pango1.0	source	buster	1.42.4-7~deb10u1	DSA-4496-1
pango1.0	source	(unstable)	1.42.4-7		933860

Notes

[stretch] - pango1.0 <not-affected> (Vulnerable code introduced later)
[jessie] - pango1.0 <not-affected> (Vulnerable code introduced later)
https://gitlab.gnome.org/GNOME/pango/issues/342
https://gitlab.gnome.org/GNOME/pango/commit/490f8979a260c16b1df055eab386345da18a2d54 (1.44)