pango-1.42.4-4.el7

Pango is a library for laying out and rendering of text, with an emphasis
on internationalization. Pango can be used anywhere that text layout is needed,
though most of the work on Pango so far has been done in the context of the
GTK+ widget toolkit. Pango forms the core of text and font handling for GTK+.
Pango is designed to be modular; the core Pango layout engine can be used
with different font backends.
The integration of Pango with Cairo provides a complete solution with high
quality text handling and graphics rendering.

Security Fix(es):

* pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow
(CVE-2019-1010238)

CVE-2019-1010238
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The
heap based buffer overflow can be used to get code execution. The component is:
function name: pango_log2vis_get_embedding_levels, assignment of nchars and the
loop condition. The attack vector is: Bug can be used when application pass
invalid utf-8 strings to functions like pango_itemize.