CentOS 4 : evolution28-pango (CESA-2011:1325)

{"result": {"cve": [{"id": "CVE-2011-3193", "type": "cve", "title": "CVE-2011-3193", "description": "Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.", "published": "2012-06-15T20:55:03", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3193", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-08-29T11:19:40"}], "openvas": [{"id": "OPENVAS:870488", "type": "openvas", "title": "RedHat Update for frysk RHSA-2011:1327-01", "description": "Check for the Version of frysk", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=870488", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-27T10:55:23"}, {"id": "OPENVAS:870492", "type": "openvas", "title": "RedHat Update for pango RHSA-2011:1326-01", "description": "Check for the Version of pango", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=870492", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-27T10:55:13"}, {"id": "OPENVAS:881297", "type": "openvas", "title": "CentOS Update for frysk CESA-2011:1327 centos4 x86_64", "description": "Check for the Version of frysk", "published": "2012-07-30T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=881297", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-25T10:50:55"}, {"id": "OPENVAS:880999", "type": "openvas", "title": "CentOS Update for pango CESA-2011:1326 centos5 i386", "description": "Check for the Version of pango", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=880999", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-25T10:55:18"}, {"id": "OPENVAS:881308", "type": "openvas", "title": "CentOS Update for evolution28-pango CESA-2011:1325 centos4 x86_64", "description": "Check for the Version of evolution28-pango", "published": "2012-07-30T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=881308", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-25T10:51:16"}, {"id": "OPENVAS:870490", "type": "openvas", "title": "RedHat Update for evolution28-pango RHSA-2011:1325-01", "description": "Check for the Version of evolution28-pango", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=870490", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-27T10:55:29"}, {"id": "OPENVAS:881426", "type": "openvas", "title": "CentOS Update for pango CESA-2011:1326 centos5 x86_64", "description": "Check for the Version of pango", "published": "2012-07-30T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=881426", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-25T10:51:17"}, {"id": "OPENVAS:880997", "type": "openvas", "title": "CentOS Update for frysk CESA-2011:1327 centos4 i386", "description": "Check for the Version of frysk", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=880997", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-25T10:55:45"}, {"id": "OPENVAS:881009", "type": "openvas", "title": "CentOS Update for evolution28-pango CESA-2011:1325 centos4 i386", "description": "Check for the Version of evolution28-pango", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=881009", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-25T10:55:40"}, {"id": "OPENVAS:1361412562310122085", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2011-1326", "description": "Oracle Linux Local Security Checks ELSA-2011-1326", "published": "2015-10-06T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122085", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-07-24T12:52:16"}], "nessus": [{"id": "REDHAT-RHSA-2011-1326.NASL", "type": "nessus", "title": "RHEL 5 : pango (RHSA-2011:1326)", "description": "Updated pango packages that fix one security issue are now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nPango is a library used for the layout and rendering of internationalized text.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, you must restart your system or restart the X server for the update to take effect.", "published": "2011-09-22T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=56253", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-01-05T02:14:04"}, {"id": "ORACLELINUX_ELSA-2011-1327.NASL", "type": "nessus", "title": "Oracle Linux 4 : frysk (ELSA-2011-1327)", "description": "From Red Hat Security Advisory 2011:1327 :\n\nAn updated frysk package that fixes one security issue is now available for Red Hat Enterprise Linux 4.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nfrysk is an execution-analysis technology implemented using native Java and C++. It provides developers and system administrators with the ability to examine and analyze multi-host, multi-process, and multithreaded systems while they are running. frysk is released as a Technology Preview for Red Hat Enterprise Linux 4.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in the embedded Pango library. If a frysk application were used to debug or trace a process that uses HarfBuzz while it loaded a specially crafted font file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of frysk are advised to upgrade to this updated package, which contains a backported patch to correct this issue. All running frysk applications must be restarted for this update to take effect.", "published": "2013-07-12T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=68357", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:23:38"}, {"id": "ORACLELINUX_ELSA-2011-1326.NASL", "type": "nessus", "title": "Oracle Linux 5 : pango (ELSA-2011-1326)", "description": "From Red Hat Security Advisory 2011:1326 :\n\nUpdated pango packages that fix one security issue are now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nPango is a library used for the layout and rendering of internationalized text.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, you must restart your system or restart the X server for the update to take effect.", "published": "2013-07-12T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=68356", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:24:11"}, {"id": "SL_20110921_PANGO_ON_SL5_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : pango on SL5.x i386/x86_64", "description": "Pango is a library used for the layout and rendering of internationalized text.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, you must restart your system or restart the X server for the update to take effect.", "published": "2012-08-01T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=61139", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:24:38"}, {"id": "CENTOS_RHSA-2011-1327.NASL", "type": "nessus", "title": "CentOS 4 : frysk (CESA-2011:1327)", "description": "An updated frysk package that fixes one security issue is now available for Red Hat Enterprise Linux 4.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nfrysk is an execution-analysis technology implemented using native Java and C++. It provides developers and system administrators with the ability to examine and analyze multi-host, multi-process, and multithreaded systems while they are running. frysk is released as a Technology Preview for Red Hat Enterprise Linux 4.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in the embedded Pango library. If a frysk application were used to debug or trace a process that uses HarfBuzz while it loaded a specially crafted font file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of frysk are advised to upgrade to this updated package, which contains a backported patch to correct this issue. All running frysk applications must be restarted for this update to take effect.", "published": "2011-09-23T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=56276", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:23:58"}, {"id": "ORACLELINUX_ELSA-2011-1325.NASL", "type": "nessus", "title": "Oracle Linux 4 : evolution28-pango (ELSA-2011-1325)", "description": "From Red Hat Security Advisory 2011:1325 :\n\nUpdated evolution28-pango packages that fix one security issue are now available for Red Hat Enterprise Linux 4.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nPango is a library used for the layout and rendering of internationalized text.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of evolution28-pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.\nAfter installing this update, you must restart your system or restart the X server for the update to take effect.", "published": "2013-07-12T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=68355", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:26:04"}, {"id": "CENTOS_RHSA-2011-1326.NASL", "type": "nessus", "title": "CentOS 5 : pango (CESA-2011:1326)", "description": "Updated pango packages that fix one security issue are now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nPango is a library used for the layout and rendering of internationalized text.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, you must restart your system or restart the X server for the update to take effect.", "published": "2011-09-22T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=56249", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:25:45"}, {"id": "SL_20110921_EVOLUTION28_PANGO_ON_SL4_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : evolution28-pango on SL4.x i386/x86_64", "description": "Pango is a library used for the layout and rendering of internationalized text.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of evolution28-pango are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.\nAfter installing this update, you must restart your system or restart the X server for the update to take effect.", "published": "2012-08-01T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=61137", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:25:41"}, {"id": "REDHAT-RHSA-2011-1327.NASL", "type": "nessus", "title": "RHEL 4 : frysk (RHSA-2011:1327)", "description": "An updated frysk package that fixes one security issue is now available for Red Hat Enterprise Linux 4.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nfrysk is an execution-analysis technology implemented using native Java and C++. It provides developers and system administrators with the ability to examine and analyze multi-host, multi-process, and multithreaded systems while they are running. frysk is released as a Technology Preview for Red Hat Enterprise Linux 4.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in the embedded Pango library. If a frysk application were used to debug or trace a process that uses HarfBuzz while it loaded a specially crafted font file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of frysk are advised to upgrade to this updated package, which contains a backported patch to correct this issue. All running frysk applications must be restarted for this update to take effect.", "published": "2011-09-22T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=56254", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-01-05T02:14:44"}, {"id": "SL_20110921_FRYSK_ON_SL4_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : frysk on SL4.x i386/x86_64", "description": "frysk is an execution-analysis technology implemented using native Java and C++. It provides developers and system administrators with the ability to examine and analyze multi-host, multi-process, and multithreaded systems while they are running. frysk is released as a Technology Preview for Scientific Linux 4.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in the embedded Pango library. If a frysk application were used to debug or trace a process that uses HarfBuzz while it loaded a specially crafted font file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)\n\nUsers of frysk are advised to upgrade to this updated package, which contains a backported patch to correct this issue. All running frysk applications must be restarted for this update to take effect.", "published": "2012-08-01T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=61138", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-26T17:24:33"}], "oraclelinux": [{"id": "ELSA-2011-1325", "type": "oraclelinux", "title": "evolution28-pango security update", "description": "[1.14.9-13.el4_11]\n- Add patch for CVE-2011-3193 (qt/harfbuzz buffer overflow).", "published": "2011-09-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2011-1325.html", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-04T11:16:48"}, {"id": "ELSA-2011-1327", "type": "oraclelinux", "title": "frysk security update", "description": "[0.0.1.2007.08.03-7.el4]\n- CVE-2011-3193 for embedded pango/harfbuzz", "published": "2011-09-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2011-1327.html", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-04T11:16:38"}, {"id": "ELSA-2011-1326", "type": "oraclelinux", "title": "pango security update", "description": "[1.14.9.8.0.1.el5_7.3]\n- Bump release\n[1.14.9.8.el5_1.3]\n- Prevent buffer overflow errors in harfbuzz module (CVE-2011-3193)\n- Resolves: #737819", "published": "2011-09-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2011-1326.html", "cvelist": ["CVE-2011-3193"], "lastseen": "2016-09-04T11:16:38"}, {"id": "ELSA-2011-1324", "type": "oraclelinux", "title": "qt4 security update", "description": "[4.2.1-1.1]\n- Resolves: #737815, qt/harfbuzz buffer overflow, CVE-2011-3193\n- Resolves: #234633, UTF-8 overlong sequence decoding vulnerability, CVE-2007-0242", "published": "2011-09-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2011-1324.html", "cvelist": ["CVE-2007-0242", "CVE-2011-3193"], "lastseen": "2016-09-04T11:16:54"}, {"id": "ELSA-2011-1323", "type": "oraclelinux", "title": "qt security update", "description": "[1:4.6.2-17.1]\n- Resolves: #rhbz737812\n fix multiple flaws in Qt\n CVE-2011-3193, CVE-2011-3194", "published": "2011-09-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2011-1323.html", "cvelist": ["CVE-2011-3193", "CVE-2011-3194"], "lastseen": "2016-09-04T11:16:36"}, {"id": "ELSA-2011-1328", "type": "oraclelinux", "title": "qt security update", "description": "[4.6.2-20]\n- Resolves: #rhbz737813\n fix multiple flaws in Qt\n CVE-2011-3193, CVE-2011-3194\n[4.6.2-19]\n- Resolves: rhbz#679759, missing executable bit in qt-examples binaries\n- Resolves: rhbz#716694, move macros.qt4 to -devel\n- Resolves: rhbz#680088, rpmdiff failure\n[4.6.2-18]\n- Resolves: rhbz#562132, Malayalam rakar is not getting reordered", "published": "2011-12-14T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://linux.oracle.com/errata/ELSA-2011-1328.html", "cvelist": ["CVE-2011-3193", "CVE-2011-3194"], "lastseen": "2016-09-04T11:16:21"}], "redhat": [{"id": "RHSA-2011:1325", "type": "redhat", "title": "(RHSA-2011:1325) Moderate: evolution28-pango security update", "description": "Pango is a library used for the layout and rendering of internationalized\ntext.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping\nengine used in Pango. If a user loaded a specially-crafted font file with\nan application that uses Pango, it could cause the application to crash or,\npossibly, execute arbitrary code with the privileges of the user running\nthe application. (CVE-2011-3193)\n\nUsers of evolution28-pango are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue. After\ninstalling this update, you must restart your system or restart the X\nserver for the update to take effect.\n", "published": "2011-09-21T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2011:1325", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-09-09T07:20:21"}, {"id": "RHSA-2011:1326", "type": "redhat", "title": "(RHSA-2011:1326) Moderate: pango security update", "description": "Pango is a library used for the layout and rendering of internationalized\ntext.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping\nengine used in Pango. If a user loaded a specially-crafted font file with\nan application that uses Pango, it could cause the application to crash or,\npossibly, execute arbitrary code with the privileges of the user running\nthe application. (CVE-2011-3193)\n\nUsers of pango are advised to upgrade to these updated packages, which\ncontain a backported patch to resolve this issue. After installing this\nupdate, you must restart your system or restart the X server for the update\nto take effect.\n", "published": "2011-09-21T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2011:1326", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-09-09T07:19:40"}, {"id": "RHSA-2011:1327", "type": "redhat", "title": "(RHSA-2011:1327) Moderate: frysk security update", "description": "frysk is an execution-analysis technology implemented using native Java and\nC++. It provides developers and system administrators with the ability to\nexamine and analyze multi-host, multi-process, and multithreaded systems\nwhile they are running. frysk is released as a Technology Preview for Red\nHat Enterprise Linux 4.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping\nengine used in the embedded Pango library. If a frysk application were used\nto debug or trace a process that uses HarfBuzz while it loaded a\nspecially-crafted font file, it could cause the application to crash or,\npossibly, execute arbitrary code with the privileges of the user running\nthe application. (CVE-2011-3193)\n\nUsers of frysk are advised to upgrade to this updated package, which\ncontains a backported patch to correct this issue. All running frysk\napplications must be restarted for this update to take effect.\n", "published": "2011-09-21T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2011:1327", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-09-09T07:20:23"}, {"id": "RHSA-2011:1324", "type": "redhat", "title": "(RHSA-2011:1324) Moderate: qt4 security update", "description": "Qt 4 is a software toolkit that simplifies the task of writing and\nmaintaining GUI (Graphical User Interface) applications for the X Window\nSystem. HarfBuzz is an OpenType text shaping engine.\n\nA flaw in the way Qt 4 expanded certain UTF-8 characters could be used to\nprevent a Qt 4 based application from properly sanitizing user input.\nDepending on the application, this could allow an attacker to perform\ndirectory traversal, or for web applications, a cross-site scripting (XSS)\nattack. (CVE-2007-0242)\n\nA buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user\nloaded a specially-crafted font file with an application linked against Qt\n4, it could cause the application to crash or, possibly, execute arbitrary\ncode with the privileges of the user running the application.\n(CVE-2011-3193)\n\nUsers of Qt 4 should upgrade to these updated packages, which contain\nbackported patches to correct these issues. All running applications linked\nagainst Qt 4 libraries must be restarted for this update to take effect.\n", "published": "2011-09-21T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2011:1324", "cvelist": ["CVE-2007-0242", "CVE-2011-3193"], "lastseen": "2017-09-09T07:19:35"}, {"id": "RHSA-2011:1328", "type": "redhat", "title": "(RHSA-2011:1328) Moderate: qt security update", "description": "Qt is a software toolkit that simplifies the task of writing and\nmaintaining GUI (Graphical User Interface) applications for the X Window\nSystem. HarfBuzz is an OpenType text shaping engine.\n\nA buffer overflow flaw was found in the harfbuzz module in Qt. If a user\nloaded a specially-crafted font file with an application linked against Qt,\nit could cause the application to crash or, possibly, execute arbitrary\ncode with the privileges of the user running the application.\n(CVE-2011-3193)\n\nA buffer overflow flaw was found in the way Qt handled certain gray-scale\nimage files. If a user loaded a specially-crafted gray-scale image file\nwith an application linked against Qt, it could cause the application to\ncrash or, possibly, execute arbitrary code with the privileges of the user\nrunning the application. (CVE-2011-3194)\n\nUsers of Qt should upgrade to these updated packages, which contain\nbackported patches to correct these issues. All running applications linked\nagainst Qt libraries must be restarted for this update to take effect.\n", "published": "2011-09-21T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2011:1328", "cvelist": ["CVE-2011-3193", "CVE-2011-3194"], "lastseen": "2017-03-07T05:19:00"}, {"id": "RHSA-2011:1323", "type": "redhat", "title": "(RHSA-2011:1323) Moderate: qt security update", "description": "Qt is a software toolkit that simplifies the task of writing and\nmaintaining GUI (Graphical User Interface) applications for the X Window\nSystem. HarfBuzz is an OpenType text shaping engine.\n\nA buffer overflow flaw was found in the harfbuzz module in Qt. If a user\nloaded a specially-crafted font file with an application linked against Qt,\nit could cause the application to crash or, possibly, execute arbitrary\ncode with the privileges of the user running the application.\n(CVE-2011-3193)\n\nA buffer overflow flaw was found in the way Qt handled certain gray-scale\nimage files. If a user loaded a specially-crafted gray-scale image file\nwith an application linked against Qt, it could cause the application to\ncrash or, possibly, execute arbitrary code with the privileges of the user\nrunning the application. (CVE-2011-3194)\n\nUsers of Qt should upgrade to these updated packages, which contain\nbackported patches to correct these issues. All running applications linked\nagainst Qt libraries must be restarted for this update to take effect.\n", "published": "2011-09-21T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2011:1323", "cvelist": ["CVE-2011-3193", "CVE-2011-3194"], "lastseen": "2017-03-10T13:18:42"}], "centos": [{"id": "CESA-2011:1325", "type": "centos", "title": "evolution28 security update", "description": "**CentOS Errata and Security Advisory** CESA-2011:1325\n\n\nPango is a library used for the layout and rendering of internationalized\ntext.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping\nengine used in Pango. If a user loaded a specially-crafted font file with\nan application that uses Pango, it could cause the application to crash or,\npossibly, execute arbitrary code with the privileges of the user running\nthe application. (CVE-2011-3193)\n\nUsers of evolution28-pango are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue. After\ninstalling this update, you must restart your system or restart the X\nserver for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/018070.html\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/018071.html\n\n**Affected packages:**\nevolution28-pango\nevolution28-pango-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2011-1325.html", "published": "2011-09-22T16:48:41", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2011-September/018070.html", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-10-03T18:25:26"}, {"id": "CESA-2011:1327", "type": "centos", "title": "frysk security update", "description": "**CentOS Errata and Security Advisory** CESA-2011:1327\n\n\nfrysk is an execution-analysis technology implemented using native Java and\nC++. It provides developers and system administrators with the ability to\nexamine and analyze multi-host, multi-process, and multithreaded systems\nwhile they are running. frysk is released as a Technology Preview for Red\nHat Enterprise Linux 4.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping\nengine used in the embedded Pango library. If a frysk application were used\nto debug or trace a process that uses HarfBuzz while it loaded a\nspecially-crafted font file, it could cause the application to crash or,\npossibly, execute arbitrary code with the privileges of the user running\nthe application. (CVE-2011-3193)\n\nUsers of frysk are advised to upgrade to this updated package, which\ncontains a backported patch to correct this issue. All running frysk\napplications must be restarted for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/018072.html\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/018073.html\n\n**Affected packages:**\nfrysk\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2011-1327.html", "published": "2011-09-22T16:50:51", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2011-September/018072.html", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-10-03T18:24:35"}, {"id": "CESA-2011:1326", "type": "centos", "title": "pango security update", "description": "**CentOS Errata and Security Advisory** CESA-2011:1326\n\n\nPango is a library used for the layout and rendering of internationalized\ntext.\n\nA buffer overflow flaw was found in HarfBuzz, an OpenType text shaping\nengine used in Pango. If a user loaded a specially-crafted font file with\nan application that uses Pango, it could cause the application to crash or,\npossibly, execute arbitrary code with the privileges of the user running\nthe application. (CVE-2011-3193)\n\nUsers of pango are advised to upgrade to these updated packages, which\ncontain a backported patch to resolve this issue. After installing this\nupdate, you must restart your system or restart the X server for the update\nto take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/017752.html\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/017753.html\n\n**Affected packages:**\npango\npango-devel\n\n**Upstream details at:**\n", "published": "2011-09-21T23:15:49", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2011-September/017752.html", "cvelist": ["CVE-2011-3193"], "lastseen": "2017-10-03T18:25:53"}, {"id": "CESA-2011:1324", "type": "centos", "title": "qt4 security update", "description": "**CentOS Errata and Security Advisory** CESA-2011:1324\n\n\nQt 4 is a software toolkit that simplifies the task of writing and\nmaintaining GUI (Graphical User Interface) applications for the X Window\nSystem. HarfBuzz is an OpenType text shaping engine.\n\nA flaw in the way Qt 4 expanded certain UTF-8 characters could be used to\nprevent a Qt 4 based application from properly sanitizing user input.\nDepending on the application, this could allow an attacker to perform\ndirectory traversal, or for web applications, a cross-site scripting (XSS)\nattack. (CVE-2007-0242)\n\nA buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user\nloaded a specially-crafted font file with an application linked against Qt\n4, it could cause the application to crash or, possibly, execute arbitrary\ncode with the privileges of the user running the application.\n(CVE-2011-3193)\n\nUsers of Qt 4 should upgrade to these updated packages, which contain\nbackported patches to correct these issues. All running applications linked\nagainst Qt 4 libraries must be restarted for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/017754.html\nhttp://lists.centos.org/pipermail/centos-announce/2011-September/017755.html\n\n**Affected packages:**\nqt4\nqt4-devel\nqt4-doc\nqt4-mysql\nqt4-odbc\nqt4-postgresql\nqt4-sqlite\n\n**Upstream details at:**\n", "published": "2011-09-21T23:19:27", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2011-September/017754.html", "cvelist": ["CVE-2007-0242", "CVE-2011-3193"], "lastseen": "2017-10-03T18:26:49"}], "gentoo": [{"id": "GLSA-201311-14", "type": "gentoo", "title": "QtCore, QtGui: Multiple vulnerabilities", "description": "### Background\n\nThe Qt toolkit is a comprehensive C++ application development framework.\n\n### Description\n\nMultiple vulnerabilities have been discovered in QtCore and QtGui. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted file with an application linked against QtCore or QtGui, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll QtCore users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-qt/qtcore-4.8.4-r2\"\n \n\nAll QtGui users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-qt/qtgui-4.8.4-r1\"\n \n\nPackages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.", "published": "2013-11-22T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://security.gentoo.org/glsa/201311-14", "cvelist": ["CVE-2013-0254", "CVE-2011-3193"], "lastseen": "2016-09-06T19:46:25"}], "debian": [{"id": "DLA-117", "type": "debian", "title": "qt4-x11 -- LTS security update", "description": "* [CVE-2011-3193](<https://security-tracker.debian.org/tracker/CVE-2011-3193>)\n\nCheck for buffer overflow in Lookup_MarkMarkPos that may cause crash in this function with certain fonts.\n\n * [CVE-2011-3194](<https://security-tracker.debian.org/tracker/CVE-2011-3194>)\n\nFix tiff reader to handle TIFFTAG_SAMPLESPERPIXEL for grayscale images. The reader uses QImage::Format_Indexed8, but since the samples per pixel value this should be (non-existent) QImage::Format_Indexed16, causing memory corruption. The fix falls back to the normal way of reading tiff images.\n\nFor Debian 6 Squeeze, these issues have been fixed in qt4-x11 version 4:4.6.3-4+squeeze2", "published": "2014-12-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/2014/dla-117", "cvelist": ["CVE-2011-3193", "CVE-2011-3194"], "lastseen": "2016-09-02T12:56:34"}], "ubuntu": [{"id": "USN-1504-1", "type": "ubuntu", "title": "Qt vulnerabilities", "description": "It was discovered that Qt did not properly handle wildcard domain names or \nIP addresses in the Common Name field of X.509 certificates. An attacker \ncould exploit this to perform a man in the middle attack to view sensitive \ninformation or alter encrypted communications. This issue only affected \nUbuntu 10.04 LTS. ([CVE-2010-5076](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2010-5076>))\n\nA heap-based buffer overflow was discovered in the HarfBuzz module. If a \nuser were tricked into opening a crafted font file in a Qt application, \nan attacker could cause a denial of service or possibly execute arbitrary \ncode with the privileges of the user invoking the program. ([CVE-2011-3193](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3193>))\n\nIt was discovered that Qt did not properly handle greyscale TIFF images. \nIf a Qt application could be made to process a crafted TIFF file, an \nattacker could cause a denial of service. ([CVE-2011-3194](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2011-3194>))", "published": "2012-07-11T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://usn.ubuntu.com/usn/usn-1504-1/", "cvelist": ["CVE-2011-3193", "CVE-2011-3194", "CVE-2010-5076"], "lastseen": "2017-08-09T19:14:46"}]}}