Read the docs
TI-2011-00020 Aliases CVE-2011-0020GHSA-5c8w-jg4w-gcj2

Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in…

Priority MEDIUM 51CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.

Why it matters now

EPSS 0.18944 97th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:*up to 1.28.3VulnerableGNOME
cpe:2.3:a:gnome:pango:1.28.0:*:*:*:*:*:*:*1.28.0VulnerableGNOME
cpe:2.3:a:gnome:pango:1.28.1:*:*:*:*:*:*:*1.28.1VulnerableGNOME
cpe:2.3:a:gnome:pango:1.28.2:*:*:*:*:*:*:*1.28.2VulnerableGNOME
cpe:2.3:a:pango:pango:0.20:*:*:*:*:*:*:*0.20VulnerablePango
cpe:2.3:a:pango:pango:0.21:*:*:*:*:*:*:*0.21VulnerablePango
cpe:2.3:a:pango:pango:0.22:*:*:*:*:*:*:*0.22VulnerablePango
cpe:2.3:a:pango:pango:0.23:*:*:*:*:*:*:*0.23VulnerablePango
cpe:2.3:a:pango:pango:0.24:*:*:*:*:*:*:*0.24VulnerablePango
cpe:2.3:a:pango:pango:0.25:*:*:*:*:*:*:*0.25VulnerablePango
  • cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:* Versions up to 1.28.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:pango:1.28.0:*:*:*:*:*:*:* Versions 1.28.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:pango:1.28.1:*:*:*:*:*:*:* Versions 1.28.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:pango:1.28.2:*:*:*:*:*:*:* Versions 1.28.2 Vulnerable ·GNOME
  • cpe:2.3:a:pango:pango:0.20:*:*:*:*:*:*:* Versions 0.20 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:0.21:*:*:*:*:*:*:* Versions 0.21 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:0.22:*:*:*:*:*:*:* Versions 0.22 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:0.23:*:*:*:*:*:*:* Versions 0.23 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:0.24:*:*:*:*:*:*:* Versions 0.24 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:0.25:*:*:*:*:*:*:* Versions 0.25 Vulnerable ·Pango
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pango:pango:0.26:*:*:*:*:*:*:*0.26VulnerablePango
cpe:2.3:a:pango:pango:1.0:*:*:*:*:*:*:*1.0VulnerablePango
cpe:2.3:a:pango:pango:1.1:*:*:*:*:*:*:*1.1VulnerablePango
cpe:2.3:a:pango:pango:1.2:*:*:*:*:*:*:*1.2VulnerablePango
cpe:2.3:a:pango:pango:1.3:*:*:*:*:*:*:*1.3VulnerablePango
cpe:2.3:a:pango:pango:1.4:*:*:*:*:*:*:*1.4VulnerablePango
cpe:2.3:a:pango:pango:1.5:*:*:*:*:*:*:*1.5VulnerablePango
cpe:2.3:a:pango:pango:1.6:*:*:*:*:*:*:*1.6VulnerablePango
cpe:2.3:a:pango:pango:1.7:*:*:*:*:*:*:*1.7VulnerablePango
cpe:2.3:a:pango:pango:1.8:*:*:*:*:*:*:*1.8VulnerablePango
cpe:2.3:a:pango:pango:1.9:*:*:*:*:*:*:*1.9VulnerablePango
cpe:2.3:a:pango:pango:1.10:*:*:*:*:*:*:*1.10VulnerablePango
cpe:2.3:a:pango:pango:1.11:*:*:*:*:*:*:*1.11VulnerablePango
cpe:2.3:a:pango:pango:1.12:*:*:*:*:*:*:*1.12VulnerablePango
cpe:2.3:a:pango:pango:1.13:*:*:*:*:*:*:*1.13VulnerablePango
cpe:2.3:a:pango:pango:1.14:*:*:*:*:*:*:*1.14VulnerablePango
cpe:2.3:a:pango:pango:1.15:*:*:*:*:*:*:*1.15VulnerablePango
cpe:2.3:a:pango:pango:1.16:*:*:*:*:*:*:*1.16VulnerablePango
cpe:2.3:a:pango:pango:1.17:*:*:*:*:*:*:*1.17VulnerablePango
cpe:2.3:a:pango:pango:1.18:*:*:*:*:*:*:*1.18VulnerablePango
cpe:2.3:a:pango:pango:1.19:*:*:*:*:*:*:*1.19VulnerablePango
cpe:2.3:a:pango:pango:1.20:*:*:*:*:*:*:*1.20VulnerablePango
cpe:2.3:a:pango:pango:1.21:*:*:*:*:*:*:*1.21VulnerablePango
cpe:2.3:a:pango:pango:1.22:*:*:*:*:*:*:*1.22VulnerablePango
cpe:2.3:a:pango:pango:1.23:*:*:*:*:*:*:*1.23VulnerablePango
cpe:2.3:a:pango:pango:1.24:*:*:*:*:*:*:*1.24VulnerablePango
cpe:2.3:a:pango:pango:1.25:*:*:*:*:*:*:*1.25VulnerablePango
cpe:2.3:a:pango:pango:1.26:*:*:*:*:*:*:*1.26VulnerablePango
cpe:2.3:a:pango:pango:1.27:*:*:*:*:*:*:*1.27VulnerablePango
  • cpe:2.3:a:pango:pango:0.26:*:*:*:*:*:*:* Versions 0.26 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.26:*:*:*:*:*:*:* Versions 1.26 Vulnerable ·Pango
  • cpe:2.3:a:pango:pango:1.27:*:*:*:*:*:*:* Versions 1.27 Vulnerable ·Pango

Remediation

Red Hat 1 advisory

  • RHSA-2011:0180 Released 2011-01-27 · Red Hat rating Moderate
    pango security update
    • Red Hat Enterprise Linux (v. 5.6.z server) pango-1.14.9-8.el5_6.2, pango-1.14.9-8.el5_6.2.i386, pango-1.14.9-8.el5_6.2.ia64 +5
    • Red Hat Enterprise Linux AS version 4 evolution28-pango-1.14.9-13.el4_10, evolution28-pango-1.14.9-13.el4_10.i386, evolution28-pango-1.14.9-13.el4_10.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 6) pango-1.28.1-3.el6_0.3
    • Red Hat Enterprise Linux Desktop Optional (v. 6) pango-1.28.1-3.el6_0.3, pango-devel-1.28.1-3.el6_0.3
    • Red Hat Enterprise Linux Desktop version 4 evolution28-pango-1.14.9-13.el4_10, evolution28-pango-1.14.9-13.el4_10.i386, evolution28-pango-devel-1.14.9-13.el4_10 +1
    • Red Hat Enterprise Linux ES version 4 evolution28-pango-1.14.9-13.el4_10, evolution28-pango-1.14.9-13.el4_10.i386, evolution28-pango-1.14.9-13.el4_10.ia64 +3
    • Red Hat Enterprise Linux HPC Node (v. 6) pango-1.28.1-3.el6_0.3
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) pango-1.28.1-3.el6_0.3, pango-devel-1.28.1-3.el6_0.3
    • Red Hat Enterprise Linux Server (v. 6) pango-1.28.1-3.el6_0.3, pango-1.28.1-3.el6_0.3.ppc, pango-devel-1.28.1-3.el6_0.3 +1
    • Red Hat Enterprise Linux WS version 4 evolution28-pango-1.14.9-13.el4_10, evolution28-pango-1.14.9-13.el4_10.i386, evolution28-pango-1.14.9-13.el4_10.ia64 +3
    • Red Hat Enterprise Linux Workstation (v. 6) pango-1.28.1-3.el6_0.3, pango-devel-1.28.1-3.el6_0.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:0180
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:0180
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:0180
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:0180
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:0180
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:0180
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2011:0180
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0180
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0180
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:0180
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0180
Not affected: 1 product
  • Red Hat Enterprise Linux 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0020
  2. 2026-10-03 Alias added: GHSA-5c8w-jg4w-gcj2

References

Exploit 4

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences