Every CVE Search/ Get API key

CVE-2019-1010238

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer...

9.8 CriticalFix available

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.27%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
CVE-2019-1010238
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
CVE-2019-1010238
Updated
2026-11-02
EUVDEUVD-2019-1980 No score

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
EUVD-2019-1980
Updated
2026-11-03
GitHub AdvisoriesGHSA-wwvc-98fq-c42m 9.8

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer...

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
GHSA-wwvc-98fq-c42m
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-1010238 9.8

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
ALPINE-CVE-2019-1010238
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-110504 9.8

CVE-2019-1010238 affecting package pango for versions less than 1.44-1

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
AZL-110504
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
Show 9 moreShow less
OSVBELL-CVE-2019-1010238 9.8

CVE-2019-1010238 does not affect BellSoft software

Record
BELL-CVE-2019-1010238
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
CVE-2019-1010238
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-1010238 9.8

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
DEBIAN-CVE-2019-1010238
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-455 9.8

Gnome Pango 1.42 and later is affected by: Buffer Overflow

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

Record
JLSEC-2026-455
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVRHSA-2019:2571 9.8

Red Hat Security Advisory: pango security update

Record
RHSA-2019:2571
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2582 9.8

Red Hat Security Advisory: pango security update

Record
RHSA-2019:2582
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:3234 9.8

Red Hat Security Advisory: pango security update

Record
RHSA-2019:3234
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-9219 No score

CVE-2019-1010238 for package pango is not applicable

This CVE either no longer is or was never applicable.

Record
AZL-9219
Updated
2026-11-02
OSVMGASA-2019-0235 No score

Updated pango packages fix security vulnerability

Updated pango package fixes security vulnerability:

It was discovered that pango was subject to a heap based buffer overflow vulnerability which could be used to get code execution (CVE-2019-1010238).

Record
MGASA-2019-0235
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
pango
Alpine:v3.10
 1.42.0 up to 1.42.4-r2
1.42.4-r2
pango
Alpine:v3.11
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.12
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.13
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.14
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.15
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.16
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.17
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.18
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.19
 1.42.0 up to 1.44.1-r0
1.44.1-r0
Show 42 moreShow less
Affected packages
PackageAffectedFixed
pango
Alpine:v3.20
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.21
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.22
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.23
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.24
 1.42.0 up to 1.44.1-r0
1.44.1-r0
pango
Alpine:v3.9
 1.42.0 up to 1.42.4-r1
1.42.4-r1
pango
Azure Linux:3
 before 1.44-1
1.44-1
pango1.0
Debian:12
 before 1.42.4-7
1.42.4-7
pango1.0
Debian:13
 before 1.42.4-7
1.42.4-7
pango1.0
Debian:14
 before 1.42.4-7
1.42.4-7
pango1.0
Debian:10
 before 1.42.4-7~deb10u1, plus listed versions
1.42.4-6
1.42.4-7~deb10u1
Pango_jll
Julia
 before 1.47.0+0
1.47.0+0
pango
Mageia:7
 before 1.43.0-3.1.mga7
1.43.0-3.1.mga7
pango
Red Hat:enterprise_linux:7::client
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-devel
Red Hat:enterprise_linux:7::client
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-tests
Red Hat:enterprise_linux:7::client
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango
Red Hat:enterprise_linux:7::computenode
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-tests
Red Hat:enterprise_linux:7::computenode
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango
Red Hat:enterprise_linux:7::server
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-devel
Red Hat:enterprise_linux:7::server
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-tests
Red Hat:enterprise_linux:7::server
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango
Red Hat:enterprise_linux:7::workstation
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango-tests
Red Hat:enterprise_linux:7::workstation
 before 0:1.42.4-4.el7_7
0:1.42.4-4.el7_7
pango
Red Hat:enterprise_linux:8::appstream
 before 0:1.42.4-5.el8_0
0:1.42.4-5.el8_0
pango-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.42.4-5.el8_0
0:1.42.4-5.el8_0
pango-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.42.4-5.el8_0
0:1.42.4-5.el8_0
pango-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.42.4-5.el8_0
0:1.42.4-5.el8_0
pango-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.42.4-5.el8_0
0:1.42.4-5.el8_0
pango
Red Hat:rhel_eus:7.6::computenode
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango-debuginfo
Red Hat:rhel_eus:7.6::computenode
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango-tests
Red Hat:rhel_eus:7.6::computenode
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango
Red Hat:rhel_eus:7.6::server
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango-debuginfo
Red Hat:rhel_eus:7.6::server
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango-devel
Red Hat:rhel_eus:7.6::server
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6
pango-tests
Red Hat:rhel_eus:7.6::server
 before 0:1.42.4-3.el7_6
0:1.42.4-3.el7_6

History

History
RecordedChangedSources
factsEUVD, OSV
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-1010238 is a critical vulnerability (CVSS 9.8) in Gnome Pango, published July 19, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.27%, the 93rd percentile. Fixed in pango 1.42.4-r2.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open