CVE Feed

    Dashboard / CVE / CVE-2011-0064

    CVE-2011-0064

    The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.

    Published:Mar 1, 2011
    Last Modified:Apr 11, 2025
    EPS:Mar 7, 2011
    EPSS Score:0.03093
    CVSS Score:6.8

    Affected Products

    Vendor
    Gnome
    Product
    Pango
    Vendor
    Mozilla
    Product
    Firefox
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9
    http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html
    http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
    http://secunia.com/advisories/43559
    http://secunia.com/advisories/43572
    http://secunia.com/advisories/43578
    http://secunia.com/advisories/43800
    http://securitytracker.com/id?1025145
    http://www.debian.org/security/2011/dsa-2178
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:040
    http://www.redhat.com/support/errata/RHSA-2011-0309.html
    http://www.securityfocus.com/bid/46632
    http://www.ubuntu.com/usn/USN-1082-1
    http://www.vupen.com/english/advisories/2011/0543
    http://www.vupen.com/english/advisories/2011/0555
    http://www.vupen.com/english/advisories/2011/0558
    http://www.vupen.com/english/advisories/2011/0584
    http://www.vupen.com/english/advisories/2011/0683
    https://bugzilla.mozilla.org/show_bug.cgi?id=606997
    https://bugzilla.novell.com/show_bug.cgi?id=672502
    https://bugzilla.redhat.com/show_bug.cgi?id=678563
    https://build.opensuse.org/request/show/63070
    https://exchange.xforce.ibmcloud.com/vulnerabilities/65770
    http://cgit.freedesktop.org/harfbuzz/commit/?id=a6a79df5fe2ed2cd307e7a991346faee164e70d9
    http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056065.html
    http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
    http://secunia.com/advisories/43559
    http://secunia.com/advisories/43572
    http://secunia.com/advisories/43578
    http://secunia.com/advisories/43800
    http://securitytracker.com/id?1025145
    http://www.debian.org/security/2011/dsa-2178
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:040
    http://www.redhat.com/support/errata/RHSA-2011-0309.html
    http://www.securityfocus.com/bid/46632
    http://www.ubuntu.com/usn/USN-1082-1
    http://www.vupen.com/english/advisories/2011/0543
    http://www.vupen.com/english/advisories/2011/0555
    http://www.vupen.com/english/advisories/2011/0558
    http://www.vupen.com/english/advisories/2011/0584
    http://www.vupen.com/english/advisories/2011/0683
    https://bugzilla.mozilla.org/show_bug.cgi?id=606997
    https://bugzilla.novell.com/show_bug.cgi?id=672502
    https://bugzilla.redhat.com/show_bug.cgi?id=678563
    https://build.opensuse.org/request/show/63070
    https://exchange.xforce.ibmcloud.com/vulnerabilities/65770

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High