CVE-2020-37011

NameCVE-2020-37011
DescriptionGnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font file. Attackers can generate a specially crafted TTF file with an oversized pattern to cause an infinite malloc() loop and potentially crash the gnome-font-viewer process.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnome-font-viewer (PTS)bullseye3.34.0-2undetermined
bookworm43.0-1undetermined
trixie48.0-2undetermined
forky, sid49.0-1undetermined

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnome-font-viewersource(unstable)undetermined

Notes

https://www.exploit-db.com/exploits/48803
check, unclear upstream status

Search for package or bug name: Reporting problems