Issued:
2019-08-29
Updated:
2019-08-29

RHSA-2019:2582 - Security Advisory

Synopsis

Important: pango security update

Type/Severity

Security Advisory: Important

Topic

An update for pango is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Pango is a library for laying out and rendering of text, with an emphasis on internationalization. Pango forms the core of text and font handling for the GTK+ widget toolkit.

Security Fix(es):

  • pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0 ppc64le
  • Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0 x86_64

Fixes

  • BZ - 1737785 - CVE-2019-1010238 pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
pango-1.42.4-5.el8_0.src.rpm SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
x86_64
pango-1.42.4-5.el8_0.i686.rpm SHA-256: f3bb4fd2630cc7e73cd43fec561b947ee795ce281865df91188ea3dbdf8bb417
pango-1.42.4-5.el8_0.x86_64.rpm SHA-256: 1f20ec0b9d7247a19c59c0d7d0834e6e4c162daa2e5e2b3a4a284fd4dcf5bc91
pango-debuginfo-1.42.4-5.el8_0.i686.rpm SHA-256: 49491e09ba7795ae83c43e5a72287f650bcd80c7a6a33cef17ca957278540409
pango-debuginfo-1.42.4-5.el8_0.x86_64.rpm SHA-256: 09f474cf6f8daa08c2613735da8e67b7cca24b3636fefb42acae05f0194f6bc1
pango-debugsource-1.42.4-5.el8_0.i686.rpm SHA-256: 8b726f859b0bad8f1d2fbda3a555e66805ea5307dc2a219c0489b3a3227973ec
pango-debugsource-1.42.4-5.el8_0.x86_64.rpm SHA-256: a94d81d2cd3793c13ce87e8119bed008c389305c8c02c58e8a2033c05ed2a792
pango-devel-1.42.4-5.el8_0.i686.rpm SHA-256: 5bd5543951459c1610181b3346d7bb713e188806f5b891a896d2183da6ef10e2
pango-devel-1.42.4-5.el8_0.x86_64.rpm SHA-256: fa8927a4eac89e2ee27741a07aaee66a05ba434cac8ae1ea963f59a923bf9037
pango-tests-debuginfo-1.42.4-5.el8_0.i686.rpm SHA-256: fecd0e8d129f8e73cad6d9298eef5e9e3372f4dd6b931c4a9f54340cdc712440
pango-tests-debuginfo-1.42.4-5.el8_0.x86_64.rpm SHA-256: 690c10f563fa9561c090b4f1b72bd0c1ea8855fd6d09814fd766db15b6f21bd2

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
pango-1.42.4-5.el8_0.src.rpm SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
s390x
pango-1.42.4-5.el8_0.s390x.rpm SHA-256: d3adadfa57c8225a413605f735bb50580af60e8f33fb532cd1b147ac249f41b7
pango-debuginfo-1.42.4-5.el8_0.s390x.rpm SHA-256: 4914c338cca3d1f094102296fbef438f3aca73658e3267c9c13d8a70197a7b9d
pango-debugsource-1.42.4-5.el8_0.s390x.rpm SHA-256: 62792cd38d72167002744938645dc2f8693c674ff6f69ae8a8fa885842966e54
pango-devel-1.42.4-5.el8_0.s390x.rpm SHA-256: 46044f9d95e36f9cb548c02cbfa4eba81d4a2f45f566273e6a71d164f1019fcc
pango-tests-debuginfo-1.42.4-5.el8_0.s390x.rpm SHA-256: e9719792e1c17b7ad1fa77473096706c9d601167062a318b9f3ddc547c1c070a

Red Hat Enterprise Linux for Power, little endian 8

SRPM
pango-1.42.4-5.el8_0.src.rpm SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
ppc64le
pango-1.42.4-5.el8_0.ppc64le.rpm SHA-256: ed1213eab9efe875da03eda7a96fdf1be006af4c771aa7525de0f4a86c34d343
pango-debuginfo-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 4aa4b4adbd8de9e2cc6de166152b46b9a9fb36c4b94364efac6ebea15a837673
pango-debugsource-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 3b8a5dc861518ee73e5e5d3fd1806124d7cbaeb0b395b1326224cedd121510bc
pango-devel-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 4467808ae4b0eb4bd6816a436038a441ad68dcdbee515175100b74f12e63cf8f
pango-tests-debuginfo-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 6b336b3f23294cac15d4d6815ead466e6783e9a76b9617b80fc928590941803b

Red Hat Enterprise Linux for ARM 64 8

SRPM
pango-1.42.4-5.el8_0.src.rpm SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
aarch64
pango-1.42.4-5.el8_0.aarch64.rpm SHA-256: 0b68a1d2aea19a66a43ed0b21683260e24bfa3441f9ed49822e2b6a0f11607fb
pango-debuginfo-1.42.4-5.el8_0.aarch64.rpm SHA-256: fd51e24836eb50a576665d82f8c1d78e0a2c3c8dbbe583a76edd7302c7a04995
pango-debugsource-1.42.4-5.el8_0.aarch64.rpm SHA-256: aa466c11523cd682064dfeee3368d21efb1d1bbd6a40aac3bee9bd2123f6a282
pango-devel-1.42.4-5.el8_0.aarch64.rpm SHA-256: cd6db196b24d69afd5441800b3049b9a0e1d38dda40b251d07a27cfde1720f21
pango-tests-debuginfo-1.42.4-5.el8_0.aarch64.rpm SHA-256: b504dc959b6849af1432c71f386f6f2538618aa7f1d8ae453c0a26fc1e3dc919

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0

SRPM
pango-1.42.4-5.el8_0.src.rpm SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
ppc64le
pango-1.42.4-5.el8_0.ppc64le.rpm SHA-256: ed1213eab9efe875da03eda7a96fdf1be006af4c771aa7525de0f4a86c34d343
pango-debuginfo-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 4aa4b4adbd8de9e2cc6de166152b46b9a9fb36c4b94364efac6ebea15a837673
pango-debugsource-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 3b8a5dc861518ee73e5e5d3fd1806124d7cbaeb0b395b1326224cedd121510bc
pango-devel-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 4467808ae4b0eb4bd6816a436038a441ad68dcdbee515175100b74f12e63cf8f
pango-tests-debuginfo-1.42.4-5.el8_0.ppc64le.rpm SHA-256: 6b336b3f23294cac15d4d6815ead466e6783e9a76b9617b80fc928590941803b

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0

SRPM
pango-1.42.4-5.el8_0.src.rpm SHA-256: f4970266aa381ff1e627c0743a26623c8097e9fbdc618ea14aa5110597b2a160
x86_64
pango-1.42.4-5.el8_0.i686.rpm SHA-256: f3bb4fd2630cc7e73cd43fec561b947ee795ce281865df91188ea3dbdf8bb417
pango-1.42.4-5.el8_0.x86_64.rpm SHA-256: 1f20ec0b9d7247a19c59c0d7d0834e6e4c162daa2e5e2b3a4a284fd4dcf5bc91
pango-debuginfo-1.42.4-5.el8_0.i686.rpm SHA-256: 49491e09ba7795ae83c43e5a72287f650bcd80c7a6a33cef17ca957278540409
pango-debuginfo-1.42.4-5.el8_0.x86_64.rpm SHA-256: 09f474cf6f8daa08c2613735da8e67b7cca24b3636fefb42acae05f0194f6bc1
pango-debugsource-1.42.4-5.el8_0.i686.rpm SHA-256: 8b726f859b0bad8f1d2fbda3a555e66805ea5307dc2a219c0489b3a3227973ec
pango-debugsource-1.42.4-5.el8_0.x86_64.rpm SHA-256: a94d81d2cd3793c13ce87e8119bed008c389305c8c02c58e8a2033c05ed2a792
pango-devel-1.42.4-5.el8_0.i686.rpm SHA-256: 5bd5543951459c1610181b3346d7bb713e188806f5b891a896d2183da6ef10e2
pango-devel-1.42.4-5.el8_0.x86_64.rpm SHA-256: fa8927a4eac89e2ee27741a07aaee66a05ba434cac8ae1ea963f59a923bf9037
pango-tests-debuginfo-1.42.4-5.el8_0.i686.rpm SHA-256: fecd0e8d129f8e73cad6d9298eef5e9e3372f4dd6b931c4a9f54340cdc712440
pango-tests-debuginfo-1.42.4-5.el8_0.x86_64.rpm SHA-256: 690c10f563fa9561c090b4f1b72bd0c1ea8855fd6d09814fd766db15b6f21bd2

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.