Vulnerability Report

CVE-2011-0020

Title: Pango RCE

Memory Corruption

Proof Of Concept

PoC Available for CVE-2011-0020

CWE Category CWE-119

Published Date Jan 24, 2011

Modified Date Jun 16, 2026

Exploit Status Available

Score 7.6 CVSS v2.0

Exploit Probability (EPSS)

18.94%

Vulnerability Summary

CVE-2011-0020: Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when the FreeType2 backend is enabled, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file, related to the glyph box for an FT_Bitmap object.

Impacted Vendors

pango 1

gnome 1

Reference Links

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://openwall.com/lists/oss-security/2011/01/18/6 http://openwall.com/lists/oss-security/2011/01/20/2 http://osvdb.org/70596 http://secunia.com/advisories/42934 http://secunia.com/advisories/43100 http://www.redhat.com/support/errata/RHSA-2011-0180.html http://www.securityfocus.com/bid/45842 http://www.securitytracker.com/id?1024994 http://www.vupen.com/english/advisories/2011/0186 http://www.vupen.com/english/advisories/2011/0238 https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616 https://bugzilla.gnome.org/show_bug.cgi?id=639882 https://bugzilla.redhat.com/show_bug.cgi?id=671122 https://exchange.xforce.ibmcloud.com/vulnerabilities/64832 http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://openwall.com/lists/oss-security/2011/01/18/6 http://openwall.com/lists/oss-security/2011/01/20/2 http://osvdb.org/70596 http://secunia.com/advisories/42934 http://secunia.com/advisories/43100 http://www.redhat.com/support/errata/RHSA-2011-0180.html http://www.securityfocus.com/bid/45842 http://www.securitytracker.com/id?1024994 http://www.vupen.com/english/advisories/2011/0186 http://www.vupen.com/english/advisories/2011/0238 https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/696616 https://bugzilla.gnome.org/show_bug.cgi?id=639882 https://bugzilla.redhat.com/show_bug.cgi?id=671122 https://exchange.xforce.ibmcloud.com/vulnerabilities/64832

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.6

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:H/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2011-0020 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/35232

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 29, 2026 MODIFIED

Vulnerability data updated via NVD.

April 11, 2025 MODIFIED

Vulnerability data or affected products updated.

January 24, 2011 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:H/Au:N/C:C/I:C/A:C

Affected Stack

No specific products linked.