| Name | CVE-2020-37011 |
| Description | Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font file. Attackers can generate a specially crafted TTF file with an oversized pattern to cause an infinite malloc() loop and potentially crash the gnome-font-viewer process. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| gnome-font-viewer (PTS) | bullseye | 3.34.0-2 | undetermined |
| bookworm | 43.0-1 | undetermined |
| trixie | 48.0-2 | undetermined |
| forky, sid | 49.0-1 | undetermined |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| gnome-font-viewer | source | (unstable) | undetermined | | | |
Notes
https://www.exploit-db.com/exploits/48803
check, unclear upstream status. Doesn't reproduce with the version in trixie