CVE-2019-18397

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 13, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-18407.5A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to resCVE-2019-184087.5archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_CVE-2019-184097.8The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if thCVE-2019-18418.1A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to inteCVE-2019-184118.8Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnCVE-2019-184127.5JetBrains IDETalk plugin before version 193.4099.10 allows XXECVE-2019-184139.8In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via CVE-2019-184148.8Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lacCVE-2019-184156.1Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.CVE-2019-184166.1Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.CVE-2019-184178.8Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code executionCVE-2019-184189.8clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no se
CVE-2019-18397: High severity, CVSS 7.8 | Vulnix