Assertion failure in Pango - CVE-2018-15120

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to insufficient validation of user-supplied input processed by the pango/pango-emoji.c source code file. A remote attacker can type a series of invalid Unicode characters in the affected application, trigger an assertion failure and cause the application to crash.

Affected software

How to mitigate CVE-2018-15120

Links to Public Exploits and PoC-codes

• Exploit #6398 - Libpango 1.40.8 - Denial of Service (PoC) (June 17, 2021)

External References

• https://github.com/GNOME/pango/blob/1.42.4/NEWS
• https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f

Related Security Bulletins

• Denial of service in Pango
• Gentoo update for Pango
• OpenSUSE Linux update for pango
• Assertion failure in pango (Alpine package)
• Fedora 27 update for pango