Bug 1613550 – CVE-2018-15120 pango: application crash triggered by unicode chars in pango-emoji.c

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1613550 - (CVE-2018-15120) CVE-2018-15120 pango: application crash triggered by unicode chars in pango-emoji.c

Summary:	CVE-2018-15120 pango: application crash triggered by unicode chars in pango-e...

Status:	CLOSED NOTABUG

Aliases:	CVE-2018-15120

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20180820,repor...
Keywords:	Security

Depends On:	1619832 1619831 1624192
Blocks:	1613551
	Show dependency tree / graph

Reported:	2018-08-07 16:24 EDT by Laura Pardo
Modified:	2018-09-17 10:38 EDT (History)
CC List:	18 users (show)

See Also:
Fixed In Version:	pango 1.42.4
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-09-13 07:55:47 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Laura Pardo 2018-08-07 16:24:53 EDT

A flaw was found in Pango since versions 1.40.8 up to newer. Typing certain invalid Emoji sequences into a GTK+ application can trigger a Reachable  Assertion resulting in an application crash.

Comment 1 Stefan Cornelius 2018-08-08 08:49:18 EDT

Statement:

This issue did not affect the versions of pango as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include support for emojis.

Comment 2 Laura Pardo 2018-08-21 16:32:24 EDT

References:
https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html

Upstream patch:
https://gitlab.gnome.org/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f

Comment 3 Laura Pardo 2018-08-21 16:33:10 EDT

Created pango tracking bugs for this issue:

Affects: fedora-all [bug 1619831]

Comment 12 Laura Pardo 2018-09-17 10:38:51 EDT

Acknowledgments:

Name: Jeffery M
Upstream: GNOME Project

Note You need to log in before you can comment on or make changes to this bug.