Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-15120 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Pango

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-617 — Reachable Assertion10 documents9 sources

Severity

6.5MEDIUMNVD

EPSS

6.1%

top 9.23%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Gnome Pango Canonical Ubuntu Linux

Timeline

PublishedAug 24

Latest updateMay 13

Description

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDgnome/pango1.40.8 — 1.42.3

Also affects: Ubuntu Linux 18.04

Patches

Patch: github.com ↗Patch: mail.gnome.org ↗Patch: www.exploit-db.com ↗

🔴Vulnerability Details

GHSA

GHSA-6gmw-hfp8-7f52: libpango in Pango 1↗2022-05-13

▶

CVEList

CVE-2018-15120: libpango in Pango 1↗2018-08-24

▶

OSV

CVE-2018-15120: libpango in Pango 1↗2018-08-24

▶

💥Exploits & PoCs

Exploit-DB

Libpango 1.40.8 - Denial of Service (PoC)↗2018-08-27

▶

📋Vendor Advisories

Ubuntu

Pango vulnerability↗2018-08-22

▶

Red Hat

pango: application crash triggered by unicode chars in pango-emoji.c↗2018-08-20

▶

Debian

CVE-2018-15120: pango1.0 - libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, ...↗2018

▶

💬Community

Bugzilla

CVE-2018-15120 pango: application crash triggered by unicode chars in pango-emoji.c [fedora-all]↗2018-08-21

▶

Bugzilla

CVE-2018-15120 pango: application crash triggered by unicode chars in pango-emoji.c↗2018-08-07

▶