Pango
Vendor:
First CVE: Mar 18, 2010 · Active for 16 years
6
Total CVEs
More Total CVEs than 80% of tracked products
1.2
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 48% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Pango over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 18, 2010
16 years ago
Most Recent CVE
Jul 19, 2019
2,562 days ago
CVE Severity & Scoring
Pango6 CVEs
50%
33%
17%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network2 (33.3%)
Unknown4 (66.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low2 (33.3%)
High0 (0.0%)
Unknown4 (66.7%)
User Interaction
None1 (16.7%)
Unknown4 (66.7%)
Required1 (16.7%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None2 (33.3%)
Unknown4 (66.7%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-0020HIGH Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled | Jan 24, 2011 | 7.6 | 44 | NO | YES |
CVE-2018-15120MEDIUM libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecifie | Aug 24, 2018 | 6.5 | 38 | NO | YES |
CVE-2019-1010238CRITICAL Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_ | Jul 19, 2019 | 9.8 | 33 | NO | NO |
CVE-2011-3193HIGH Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a den | Jun 16, 2012 | 9.3 | 33 | NO | NO |
CVE-2011-0064MEDIUM The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remo | Mar 7, 2011 | 6.8 | 23 | NO | NO |
CVE-2010-0421MEDIUM Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of | Mar 18, 2010 | 4.3 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
33.3% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Pango
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.28.3 | 1 | 6.8 | 3.3% | 0 | 0 |
| 1.28.2 | 1 | 7.6 | 18.9% | 0 | 1 |
| 1.28.1 | 1 | 7.6 | 18.9% | 0 | 1 |
| 1.28.0 | 1 | 7.6 | 18.9% | 0 | 1 |