{"id":"CVE-2019-18397","aliases":["ALPINE-CVE-2019-18397","BELL-CVE-2019-18397","DEBIAN-CVE-2019-18397","DSA-4561-1","EUVD-2019-8179","GHSA-fcm8-q275-jqv2","JLSEC-2025-169","MGASA-2019-0325","RHSA-2019:4326","RHSA-2019:4361","RHSA-2020:0291","SUSE-SU-2021:1655-1","UBUNTU-CVE-2019-18397","openSUSE-SU-2021:0763-1","openSUSE-SU-2021:1655-1","openSUSE-SU-2024:10772-1"],"status":"published","title":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of...","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02182,"percentile":0.82496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2019-11-07T17:00:00Z","modified":"2026-10-20T13:42:12Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"fribidi","fixed_in":["1.0.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"fribidi","fixed_in":["1.0.7-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"fribidi","fixed_in":["1.0.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"fribidi","fixed_in":["1.0.5-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fribidi","fixed_in":["1.0.7-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fribidi","fixed_in":["1.0.7-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fribidi","fixed_in":["1.0.7-1.1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"fribidi","fixed_in":["1.0.5-3.1+deb10u1"],"sources":["osv"]},{"ecosystem":"Julia","package":"FriBidi_jll","fixed_in":["1.0.10+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"fribidi","fixed_in":["1.0.5-2.1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fribidi","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fribidi-debuginfo","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fribidi-devel","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fribidi","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fribidi-debuginfo","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fribidi-devel","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fribidi","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fribidi-debuginfo","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fribidi-devel","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fribidi","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fribidi-debuginfo","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fribidi-devel","fixed_in":["0:1.0.2-1.el7_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi","fixed_in":["0:1.0.4-7.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi-debuginfo","fixed_in":["0:1.0.4-7.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi-debugsource","fixed_in":["0:1.0.4-7.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi-devel","fixed_in":["0:1.0.4-7.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi","fixed_in":["0:1.0.4-6.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi-debuginfo","fixed_in":["0:1.0.4-6.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi-debugsource","fixed_in":["0:1.0.4-6.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi-devel","fixed_in":["0:1.0.4-6.el8_0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fribidi","fixed_in":["1.0.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fribidi","fixed_in":["1.0.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fribidi","fixed_in":["1.0.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fribidi","fixed_in":["1.0.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"fribidi","fixed_in":["1.0.5-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"fribidi","fixed_in":["1.0.5-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"fribidi","fixed_in":["1.0.5-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fribidi","fixed_in":["1.0.10-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.7-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.5-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.1+deb10u1"}]}],"versions":["1.0.5-3.1"]},{"source":"osv","ecosystem":"Julia","package":"FriBidi_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.10+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-2.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fribidi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fribidi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fribidi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fribidi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fribidi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fribidi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fribidi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fribidi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el7_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-7.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-7.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-7.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fribidi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-7.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-6.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-6.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-6.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"fribidi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-6.el8_0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fribidi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-2.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"fribidi"}],"references":[{"url":"https://github.com/fribidi/fribidi/commit/034c6e9a1d296286305f4cfd1e0072b879f52568","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://marc.info/?l=oss-security\u0026m=157322128105807\u0026w=2","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944327","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-18397","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5UJRTG32FDNI7T637Q6PZYL3UCRR5HR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4326","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFS3N6KKXPI6ATDNEUFRSLX7R6BOBNIP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4361","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0291","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202003-41","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18397","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFS3N6KKXPI6ATDNEUFRSLX7R6BOBNIP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5UJRTG32FDNI7T637Q6PZYL3UCRR5HR/"},{"url":"https://github.com/advisories/GHSA-fcm8-q275-jqv2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-18397","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-18397","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0325.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25673","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/11/08/5","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768750","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4326.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18397","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18397","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4361.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0291.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211655-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1156260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18397","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-18397","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4179-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GPZ3M35XR5IQLIBDLZFFWGW6Z6SM7YNW/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NAPU2NE5KWWCW4NS2FW7DLCSMM442VDM/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-18397","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2019-11-13T13:55:35Z","modified":"2024-08-05T01:54:14.298Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-8179","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2019-11-13T13:55:35Z","modified":"2024-08-05T01:54:14Z","updated_at":"2026-11-03T02:40:28.293703Z"}],"ghsa":[{"id":"GHSA-fcm8-q275-jqv2","title":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of...","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2022-05-24T17:00:48Z","modified":"2023-01-28T05:07:38Z","updated_at":"2026-11-02T14:44:33.090384Z"}],"nvd":[{"id":"CVE-2019-18397","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2019-11-13T14:15:10.287Z","modified":"2026-06-17T02:24:58.563Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:05:35.052973Z"}],"osv":[{"id":"ALPINE-CVE-2019-18397","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2019-11-13T14:15:10.287Z","modified":"2026-09-21T06:17:52.50265749Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-18397","title":"CVE-2019-18397 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:09.359869Z","modified":"2026-01-26T09:49:19.024295Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-18397","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2019-11-13T14:15:10.287Z","modified":"2026-10-20T13:42:12.15352286Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-18397","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2019-11-13T14:15:10.287Z","modified":"2026-09-21T07:01:17.025721644Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"JLSEC-2025-169","title":"A buffer overflow in the `fribidi_get_par_embedding_levels_ex()` function in `lib/fribidi-bidi.c` of...","description":"A buffer overflow in the `fribidi_get_par_embedding_levels_ex()` function in `lib/fribidi-bidi.c` of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"published","published":"2025-10-20T22:55:27.993Z","modified":"2026-07-23T22:30:16.189481456Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RHSA-2019:4326","title":"Red Hat Security Advisory: fribidi security update","status":"published","published":"2024-09-16T03:25:11Z","modified":"2026-06-27T10:08:44Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4361","title":"Red Hat Security Advisory: fribidi security update","status":"published","published":"2024-09-16T03:25:17Z","modified":"2026-06-27T10:08:46Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0291","title":"Red Hat Security Advisory: fribidi security update","status":"published","published":"2024-09-16T03:25:23Z","modified":"2026-06-27T10:09:05Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-18397","description":"A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.","status":"withdrawn","published":"2019-11-07T17:00:00Z","modified":"2026-02-04T03:54:27.668765Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DSA-4561-1","title":"fribidi - security update","status":"published","published":"2019-11-08T00:00:00Z","modified":"2026-03-09T02:09:56.909124Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2019-0325","title":"Updated fribidi packages fix security vulnerability","description":"Updated fribidi packages fix security vulnerability:\n\nA stack buffer overflow in the fribidi_get_par_embedding_levels_ex()\nfunction in lib/fribidi-bidi.c of GNU FriBidi 1.0.0 through 1.0.7 allows\nan attacker to cause a denial of service or possibly execute arbitrary\ncode by delivering crafted text content to a user, when this content is\nthen rendered by an  application that uses FriBidi for text layout\ncalculations (CVE-2019-18397).\n","status":"published","published":"2019-11-14T16:58:51Z","modified":"2026-04-16T04:42:44.081099447Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:0763-1","title":"Security update for fribidi","description":"This update for fribidi fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-18397: Avoid buffer overflow. (bsc#1156260)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-05-22T05:03:56Z","modified":"2026-02-04T02:58:19.979754Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1655-1","title":"Security update for fribidi","description":"This update for fribidi fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-18397: Avoid buffer overflow. (bsc#1156260)\n","status":"published","published":"2021-07-11T08:16:35Z","modified":"2026-02-04T03:20:43.333202Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10772-1","title":"fribidi-1.0.10-2.1 on GA media","description":"These are all security issues fixed in the fribidi-1.0.10-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:34:26.112249Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1655-1","title":"Security update for fribidi","description":"This update for fribidi fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-18397: Avoid buffer overflow. (bsc#1156260)\n","status":"published","published":"2021-05-19T14:44:46Z","modified":"2026-02-04T04:07:23.211423Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}