Read the docs
TI-2011-02823 Aliases CVE-2011-3193GHSA-gw56-35qp-gch8

Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module…

Priority MEDIUM 50CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.

Why it matters now

EPSS 0.07171 94th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:*before 1.25.1VulnerableGNOME
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*before 4.7.4Vulnerableqt
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*10.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*11.04VulnerableCanonical
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:*6.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
  • cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:* Versions before 1.25.1 Vulnerable ·GNOME
  • cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* Versions before 4.7.4 Vulnerable ·qt
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:* Versions 11.04 Vulnerable ·Canonical
  • cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*11.3VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*11.4VulnerableopenSUSE
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:* Versions 11.3 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·openSUSE

Remediation

Red Hat 6 advisories

  • RHSA-2011:1328 Released 2011-09-21 · Red Hat rating Moderate
    qt security update
    • Red Hat Enterprise Linux Desktop (v. 6) phonon-backend-gstreamer-1:4.6.2-20.el6, qt-1:4.6.2-20.el6, qt-mysql-1:4.6.2-20.el6 +4
    • Red Hat Enterprise Linux Desktop Optional (v. 6) qt-1:4.6.2-20.el6, qt-demos-1:4.6.2-20.el6, qt-devel-1:4.6.2-20.el6 +2
    • Red Hat Enterprise Linux HPC Node (v. 6) phonon-backend-gstreamer-1:4.6.2-20.el6, qt-1:4.6.2-20.el6, qt-sqlite-1:4.6.2-20.el6 +1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) phonon-backend-gstreamer-1:4.6.2-20.el6, qt-1:4.6.2-20.el6, qt-demos-1:4.6.2-20.el6 +8
    • Red Hat Enterprise Linux Server (v. 6) phonon-backend-gstreamer-1:4.6.2-20.el6, phonon-backend-gstreamer-1:4.6.2-20.el6.ppc, qt-1:4.6.2-20.el6 +14
    • Red Hat Enterprise Linux Server Optional (v. 6) qt-1:4.6.2-20.el6, qt-demos-1:4.6.2-20.el6, qt-examples-1:4.6.2-20.el6
    • Red Hat Enterprise Linux Workstation (v. 6) phonon-backend-gstreamer-1:4.6.2-20.el6, qt-1:4.6.2-20.el6, qt-devel-1:4.6.2-20.el6 +6
    • Red Hat Enterprise Linux Workstation Optional (v. 6) qt-1:4.6.2-20.el6, qt-demos-1:4.6.2-20.el6, qt-examples-1:4.6.2-20.el6
  • RHSA-2011:1323 Released 2011-09-21 · Red Hat rating Moderate
    qt security update
    • Red Hat Enterprise Linux Server (v. 6) phonon-backend-gstreamer-1:4.6.2-17.el6_1.1, phonon-backend-gstreamer-1:4.6.2-17.el6_1.1.ppc, qt-1:4.6.2-17.el6_1.1 +14
    • Red Hat Enterprise Linux Server Optional (v. 6) qt-1:4.6.2-17.el6_1.1, qt-demos-1:4.6.2-17.el6_1.1, qt-examples-1:4.6.2-17.el6_1.1
  • RHSA-2011:1327 Released 2011-09-21 · Red Hat rating Moderate
    frysk security update
    • Red Hat Enterprise Linux AS version 4 frysk-0.0.1.2007.08.03-8.el4, frysk-0.0.1.2007.08.03-8.el4.i386
    • Red Hat Enterprise Linux Desktop version 4 frysk-0.0.1.2007.08.03-8.el4, frysk-0.0.1.2007.08.03-8.el4.i386
    • Red Hat Enterprise Linux ES version 4 frysk-0.0.1.2007.08.03-8.el4, frysk-0.0.1.2007.08.03-8.el4.i386
    • Red Hat Enterprise Linux WS version 4 frysk-0.0.1.2007.08.03-8.el4, frysk-0.0.1.2007.08.03-8.el4.i386
Show 3 more Red Hat advisories
  • RHSA-2011:1326 Released 2011-09-21 · Red Hat rating Moderate
    pango security update
    • RHEL Desktop Workstation (v. 5 client) pango-1.14.9-8.el5_7.3, pango-devel-1.14.9-8.el5_7.3, pango-devel-1.14.9-8.el5_7.3.i386
    • Red Hat Enterprise Linux (v. 5 server) pango-1.14.9-8.el5_7.3, pango-1.14.9-8.el5_7.3.i386, pango-1.14.9-8.el5_7.3.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) pango-1.14.9-8.el5_7.3, pango-1.14.9-8.el5_7.3.i386
  • RHSA-2011:1324 Released 2011-09-21 · Red Hat rating Moderate
    qt4 security update
    • RHEL Desktop Workstation (v. 5 client) qt4-4.2.1-1.el5_7.1, qt4-devel-4.2.1-1.el5_7.1, qt4-devel-4.2.1-1.el5_7.1.i386
    • Red Hat Enterprise Linux (v. 5 server) qt4-4.2.1-1.el5_7.1, qt4-4.2.1-1.el5_7.1.i386, qt4-4.2.1-1.el5_7.1.ia64 +25
    • Red Hat Enterprise Linux Desktop (v. 5 client) qt4-4.2.1-1.el5_7.1, qt4-4.2.1-1.el5_7.1.i386, qt4-doc-4.2.1-1.el5_7.1 +9
  • RHSA-2011:1325 Released 2011-09-21 · Red Hat rating Moderate
    evolution28-pango security update
    • Red Hat Enterprise Linux AS version 4 evolution28-pango-1.14.9-13.el4_11, evolution28-pango-1.14.9-13.el4_11.i386, evolution28-pango-1.14.9-13.el4_11.ia64 +5
    • Red Hat Enterprise Linux Desktop version 4 evolution28-pango-1.14.9-13.el4_11, evolution28-pango-1.14.9-13.el4_11.i386, evolution28-pango-devel-1.14.9-13.el4_11 +1
    • Red Hat Enterprise Linux ES version 4 evolution28-pango-1.14.9-13.el4_11, evolution28-pango-1.14.9-13.el4_11.i386, evolution28-pango-1.14.9-13.el4_11.ia64 +3
    • Red Hat Enterprise Linux WS version 4 evolution28-pango-1.14.9-13.el4_11, evolution28-pango-1.14.9-13.el4_11.i386, evolution28-pango-1.14.9-13.el4_11.ia64 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2011:1324, RHSA-2011:1326
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2011:1324, RHSA-2011:1326
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:1325, RHSA-2011:1327
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2011:1324, RHSA-2011:1326
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:1328
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:1328
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:1325, RHSA-2011:1327
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:1325, RHSA-2011:1327
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2011:1328
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:1328
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1323, RHSA-2011:1328
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:1323, RHSA-2011:1328
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:1325, RHSA-2011:1327
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:1328
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2011:1328
Not affected: 3 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3193
  2. 2026-10-03 Alias added: GHSA-gw56-35qp-gch8

References

Patch 3

Advisory 13

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences