UBUNTU-CVE-2019-18397

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-18397

    UBUNTU-CVE-2019-18397

    Published: 7 Nov 2019Last Modified: 4 Feb 2026
    Upstream:
    CVE-2019-18397
    Aliases:
    USN-4179-1

    Summary:

    Details: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

    References: https://ubuntu.com/security/CVE-2019-18397, https://ubuntu.com/security/notices/USN-4179-1, https://www.cve.org/CVERecord?id=CVE-2019-18397

    Affected packages

    Package

    Name: fribidi

    Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.19.7-1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2019-18397 | CVE-DB