CVE-2012-1176: Buffer Overflow in PyFriBidi
Summary
CVE-2012-1176: Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence. Affects pyfribidi across 2 version ranges.
< 0.11.0
< d2860c655357975e7b32d84e6b45e98f0dcecd7a
Fixed in d2860c655357975e7b32d84e6b45e98f0dcecd7a. How to fix ↓
Also tracked for
- pyfribidi · Debian:11
The same CVE-2012-1176 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyFriBidi is a Python library that provides Unicode Bidirectional Algorithm (UBA) functionality. It allows users to handle bidirectional text, which is commonly used in languages such as Arabic and Hebrew. This vulnerability affects versions of PyFriBidi before 0.11.0. The fribidi_utf8_to_unicode function in PyFriBidi is susceptible to a buffer overflow, which can be exploited by remote attackers. By sending a specially crafted 4-byte utf-8 sequence, an attacker can cause the application to crash, resulting in a denial of service.
Vulnerability Detail
The vulnerability in PyFriBidi arises from a buffer overflow in the fribidi_utf8_to_unicode function. This function is responsible for converting utf-8 encoded text to Unicode. By sending a maliciously crafted utf-8 sequence, an attacker can trigger a buffer overflow, leading to a crash of the application. This vulnerability can be exploited remotely, allowing an attacker to disrupt the normal operation of the affected application. It is important to note that this vulnerability only affects versions of PyFriBidi prior to 0.11.0.
How To Fix
Minimum fixed version
d2860c655357975e7b32d84e6b45e98f0dcecd7a
This is the first release that contains the fix.
pip install --upgrade "pyfribidi==d2860c655357975e7b32d84e6b45e98f0dcecd7a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The buffer overflow vulnerability in PyFriBidi can be exploited remotely, causing a denial of service. To mitigate this issue, it is crucial to update PyFriBidi to version 0.11.0 or later. This update includes a fix for the buffer overflow. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyfribidi →
FAQ
PyFriBidi is a Python library that provides Unicode Bidirectional Algorithm (UBA) functionality. It allows users to handle bidirectional text, commonly used in languages such as Arabic and Hebrew.
This vulnerability allows remote attackers to cause a denial of service (application crash) by sending a specially crafted utf-8 sequence. It can disrupt the normal operation of the affected application.
Versions of PyFriBidi prior to 0.11.0 are affected by this vulnerability.
To fix this vulnerability, update PyFriBidi to version 0.11.0 or later by running the command: pip install --upgrade pyfribidi.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for pyfribidi.
