CVE-2019-1010238: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2019-1010238 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 6.27% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-07-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
CVSS metrics
5 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.27%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat14 products
- enterprise_linux8.0
- enterprise_linux_desktop7.0
- enterprise_linux_eus7.4 | 7.6 | 8.1 | 8.2 | 8.4
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6 | 7.7 | 8.2 | 8.4
Debian2 products
- pango1.0< 1.42.4-7 | < 1.42.4-7~deb10u1
- debian_linuxEOL10.0
Alpine1 product
- pango≥ 1.42.0, < 1.42.4-r2 | ≥ 1.42.0, < 1.44.1-r0 | ≥ 1.42.0, < 1.42.4-r1
Canonical1 product
- ubuntu_linuxEOL19.04
Fedoraproject1 product
- fedoraEOL29 | 30
Gnome1 product
- pango1.42 and later | ≥ 1.42.0, ≤ 1.44
Mageia1 product
- pango< 1.43.0-3.1.mga7
Oracle1 product
- sd-wan_edge7.3 | 8.0 | 8.1 | 8.2
8 vendors · 22 products
References
28 links
- access.redhat.com/errata/RHSA-2019:2571Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2019:2582Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
Show all 28 references
- access.redhat.com/errata/RHSA-2019:3234Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- gitlab.gnome.org/GNOME/pango/-/commits/main/pango/pango-bidi-type.cX Refsource MISCPatchVendor Advisory
