Issued:
2011-09-21
Updated:
2011-09-21

RHSA-2011:1326 - Security Advisory

Synopsis

Moderate: pango security update

Type/Severity

Security Advisory: Moderate

Topic

Updated pango packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Pango is a library used for the layout and rendering of internationalized
text.

A buffer overflow flaw was found in HarfBuzz, an OpenType text shaping
engine used in Pango. If a user loaded a specially-crafted font file with
an application that uses Pango, it could cause the application to crash or,
possibly, execute arbitrary code with the privileges of the user running
the application. (CVE-2011-3193)

Users of pango are advised to upgrade to these updated packages, which
contain a backported patch to resolve this issue. After installing this
update, you must restart your system or restart the X server for the update
to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 733118 - CVE-2011-3193 qt/harfbuzz buffer overflow

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
pango-1.14.9-8.el5_7.3.src.rpm SHA-256: ead28ad4ff05a90230af23a561783565b373bcdab2f8b3789fbf0ec98ed06252
x86_64
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: 45cc656e0cba9325e0faaebbd1454b59f1bbba97c8037c6b8b1654b65a021196
pango-devel-1.14.9-8.el5_7.3.i386.rpm SHA-256: 7ed357c09639b5197f070c2ae7935b0fb86deef4680102faf4c67db0abc99c65
pango-devel-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: c9cc5dc25130165e0da31f55723985ca50c1d092641d56baa2229d29f55dd44d
ia64
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-1.14.9-8.el5_7.3.ia64.rpm SHA-256: 6cb539ae2c00d87381eb13999f60ea69876a8f1bf884377d0d24916dbff0aa99
pango-devel-1.14.9-8.el5_7.3.ia64.rpm SHA-256: a6e878d18b519ff43601ab883fc3b92f1d54e9243e074b154f72719acb3147f0
i386
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-devel-1.14.9-8.el5_7.3.i386.rpm SHA-256: 7ed357c09639b5197f070c2ae7935b0fb86deef4680102faf4c67db0abc99c65

Red Hat Enterprise Linux Workstation 5

SRPM
pango-1.14.9-8.el5_7.3.src.rpm SHA-256: ead28ad4ff05a90230af23a561783565b373bcdab2f8b3789fbf0ec98ed06252
x86_64
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: 45cc656e0cba9325e0faaebbd1454b59f1bbba97c8037c6b8b1654b65a021196
pango-devel-1.14.9-8.el5_7.3.i386.rpm SHA-256: 7ed357c09639b5197f070c2ae7935b0fb86deef4680102faf4c67db0abc99c65
pango-devel-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: c9cc5dc25130165e0da31f55723985ca50c1d092641d56baa2229d29f55dd44d
i386
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-devel-1.14.9-8.el5_7.3.i386.rpm SHA-256: 7ed357c09639b5197f070c2ae7935b0fb86deef4680102faf4c67db0abc99c65

Red Hat Enterprise Linux Desktop 5

SRPM
pango-1.14.9-8.el5_7.3.src.rpm SHA-256: ead28ad4ff05a90230af23a561783565b373bcdab2f8b3789fbf0ec98ed06252
x86_64
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: 45cc656e0cba9325e0faaebbd1454b59f1bbba97c8037c6b8b1654b65a021196
i386
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
pango-1.14.9-8.el5_7.3.src.rpm SHA-256: ead28ad4ff05a90230af23a561783565b373bcdab2f8b3789fbf0ec98ed06252
s390x
pango-1.14.9-8.el5_7.3.s390.rpm SHA-256: 02ab1bd9284b793794684b355bba3cd818bef04ff353e46232b8e59e22535df0
pango-1.14.9-8.el5_7.3.s390x.rpm SHA-256: 266b8942d85e754562793ab10372e5a1470387ff0d67dc353a956dffa6d294b0
pango-devel-1.14.9-8.el5_7.3.s390.rpm SHA-256: d8f85567ab3015752ec8f1d716818bdf25ca814bc88d954b520ca7afa2e77fc7
pango-devel-1.14.9-8.el5_7.3.s390x.rpm SHA-256: efb0381be4a1871ba937bc893989da102ad659ea082ab59a1d4b628deea037a1

Red Hat Enterprise Linux for Power, big endian 5

SRPM
pango-1.14.9-8.el5_7.3.src.rpm SHA-256: ead28ad4ff05a90230af23a561783565b373bcdab2f8b3789fbf0ec98ed06252
ppc
pango-1.14.9-8.el5_7.3.ppc.rpm SHA-256: 9198b7dc5b0da3fbb8160e0a7c06a33a5d86c1c041302ea5d0503667a76dc4a0
pango-1.14.9-8.el5_7.3.ppc64.rpm SHA-256: 6051d64a0c2e491da02b4d412c38de2b0a08cd4c43197d3990bc1990ab2c76f3
pango-devel-1.14.9-8.el5_7.3.ppc.rpm SHA-256: 67d877e583b891eb8d1d89f1e7843f5b021a1bec4f33329ab921cc2db08d7fb7
pango-devel-1.14.9-8.el5_7.3.ppc64.rpm SHA-256: 50fa711170b7e4afc629390a004f8430583780191a0a5cb5333dadf1d3a5e4df

Red Hat Enterprise Linux Server from RHUI 5

SRPM
pango-1.14.9-8.el5_7.3.src.rpm SHA-256: ead28ad4ff05a90230af23a561783565b373bcdab2f8b3789fbf0ec98ed06252
x86_64
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: 45cc656e0cba9325e0faaebbd1454b59f1bbba97c8037c6b8b1654b65a021196
pango-devel-1.14.9-8.el5_7.3.i386.rpm SHA-256: 7ed357c09639b5197f070c2ae7935b0fb86deef4680102faf4c67db0abc99c65
pango-devel-1.14.9-8.el5_7.3.x86_64.rpm SHA-256: c9cc5dc25130165e0da31f55723985ca50c1d092641d56baa2229d29f55dd44d
i386
pango-1.14.9-8.el5_7.3.i386.rpm SHA-256: 164c64fd88b4e8e16c90aafefa3bf3bdb7b8b934269a863eefc8b33c032df4e9
pango-devel-1.14.9-8.el5_7.3.i386.rpm SHA-256: 7ed357c09639b5197f070c2ae7935b0fb86deef4680102faf4c67db0abc99c65

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.