Synopsis

Important: pango security update

Type/Severity

Security Advisory: Important

Topic

An update for pango is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango forms the core of text and font handling for the GTK+ widget toolkit.

Security Fix(es):

• pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1737785 - CVE-2019-1010238 pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow

CVEs

• CVE-2019-1010238

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 8

SRPM
pango-1.42.4-5.el8_0.src.rpm	SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
x86_64
pango-1.42.4-5.el8_0.i686.rpm	SHA-256: f3bb4fd2630cc7e73cd43fec561b947ee795ce281865df91188ea3dbdf8bb417
pango-1.42.4-5.el8_0.x86_64.rpm	SHA-256: 1f20ec0b9d7247a19c59c0d7d0834e6e4c162daa2e5e2b3a4a284fd4dcf5bc91
pango-debuginfo-1.42.4-5.el8_0.i686.rpm	SHA-256: 49491e09ba7795ae83c43e5a72287f650bcd80c7a6a33cef17ca957278540409
pango-debuginfo-1.42.4-5.el8_0.x86_64.rpm	SHA-256: 09f474cf6f8daa08c2613735da8e67b7cca24b3636fefb42acae05f0194f6bc1
pango-debugsource-1.42.4-5.el8_0.i686.rpm	SHA-256: 8b726f859b0bad8f1d2fbda3a555e66805ea5307dc2a219c0489b3a3227973ec
pango-debugsource-1.42.4-5.el8_0.x86_64.rpm	SHA-256: a94d81d2cd3793c13ce87e8119bed008c389305c8c02c58e8a2033c05ed2a792
pango-devel-1.42.4-5.el8_0.i686.rpm	SHA-256: 5bd5543951459c1610181b3346d7bb713e188806f5b891a896d2183da6ef10e2
pango-devel-1.42.4-5.el8_0.x86_64.rpm	SHA-256: fa8927a4eac89e2ee27741a07aaee66a05ba434cac8ae1ea963f59a923bf9037
pango-tests-debuginfo-1.42.4-5.el8_0.i686.rpm	SHA-256: fecd0e8d129f8e73cad6d9298eef5e9e3372f4dd6b931c4a9f54340cdc712440
pango-tests-debuginfo-1.42.4-5.el8_0.x86_64.rpm	SHA-256: 690c10f563fa9561c090b4f1b72bd0c1ea8855fd6d09814fd766db15b6f21bd2

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
pango-1.42.4-5.el8_0.src.rpm	SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
s390x
pango-1.42.4-5.el8_0.s390x.rpm	SHA-256: d3adadfa57c8225a413605f735bb50580af60e8f33fb532cd1b147ac249f41b7
pango-debuginfo-1.42.4-5.el8_0.s390x.rpm	SHA-256: 4914c338cca3d1f094102296fbef438f3aca73658e3267c9c13d8a70197a7b9d
pango-debugsource-1.42.4-5.el8_0.s390x.rpm	SHA-256: 62792cd38d72167002744938645dc2f8693c674ff6f69ae8a8fa885842966e54
pango-devel-1.42.4-5.el8_0.s390x.rpm	SHA-256: 46044f9d95e36f9cb548c02cbfa4eba81d4a2f45f566273e6a71d164f1019fcc
pango-tests-debuginfo-1.42.4-5.el8_0.s390x.rpm	SHA-256: e9719792e1c17b7ad1fa77473096706c9d601167062a318b9f3ddc547c1c070a

Red Hat Enterprise Linux for Power, little endian 8

SRPM
pango-1.42.4-5.el8_0.src.rpm	SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
ppc64le
pango-1.42.4-5.el8_0.ppc64le.rpm	SHA-256: ed1213eab9efe875da03eda7a96fdf1be006af4c771aa7525de0f4a86c34d343
pango-debuginfo-1.42.4-5.el8_0.ppc64le.rpm	SHA-256: 4aa4b4adbd8de9e2cc6de166152b46b9a9fb36c4b94364efac6ebea15a837673
pango-debugsource-1.42.4-5.el8_0.ppc64le.rpm	SHA-256: 3b8a5dc861518ee73e5e5d3fd1806124d7cbaeb0b395b1326224cedd121510bc
pango-devel-1.42.4-5.el8_0.ppc64le.rpm	SHA-256: 4467808ae4b0eb4bd6816a436038a441ad68dcdbee515175100b74f12e63cf8f
pango-tests-debuginfo-1.42.4-5.el8_0.ppc64le.rpm	SHA-256: 6b336b3f23294cac15d4d6815ead466e6783e9a76b9617b80fc928590941803b

Red Hat Enterprise Linux for ARM 64 8

SRPM
pango-1.42.4-5.el8_0.src.rpm	SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
aarch64
pango-1.42.4-5.el8_0.aarch64.rpm	SHA-256: 0b68a1d2aea19a66a43ed0b21683260e24bfa3441f9ed49822e2b6a0f11607fb
pango-debuginfo-1.42.4-5.el8_0.aarch64.rpm	SHA-256: fd51e24836eb50a576665d82f8c1d78e0a2c3c8dbbe583a76edd7302c7a04995
pango-debugsource-1.42.4-5.el8_0.aarch64.rpm	SHA-256: aa466c11523cd682064dfeee3368d21efb1d1bbd6a40aac3bee9bd2123f6a282
pango-devel-1.42.4-5.el8_0.aarch64.rpm	SHA-256: cd6db196b24d69afd5441800b3049b9a0e1d38dda40b251d07a27cfde1720f21
pango-tests-debuginfo-1.42.4-5.el8_0.aarch64.rpm	SHA-256: b504dc959b6849af1432c71f386f6f2538618aa7f1d8ae453c0a26fc1e3dc919