CVE-2019-18397
📋 TL;DR
A buffer overflow vulnerability in GNU FriBidi's fribidi_get_par_embedding_levels_ex() function allows attackers to cause denial of service or potentially execute arbitrary code by delivering crafted text content. This affects any application using FriBidi for bidirectional text layout, including GNOME/GTK+ applications using Pango like GEdit and HexChat. Users of affected applications on systems with vulnerable FriBidi versions are at risk.
💻 Affected Systems
- GNU FriBidi
- Pango
- GNOME applications
- GTK+ applications
- GEdit
- HexChat
- Any application using FriBidi for bidirectional text
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application processing the crafted text, potentially leading to full system compromise.
Likely Case
Application crash causing denial of service, disrupting user workflows and potentially causing data loss.
If Mitigated
Limited impact if applications run with minimal privileges and proper sandboxing, though crashes may still occur.
🎯 Exploit Status
Exploitation requires delivering crafted text to vulnerable applications. Proof of concept exists in commit references and bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FriBidi 1.0.8 and later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2019:4326
Restart Required: Yes
Instructions:
1. Update FriBidi to version 1.0.8 or later via system package manager. 2. Update dependent applications (Pango, GNOME/GTK+ apps). 3. Restart affected applications or the system.
🔧 Temporary Workarounds
Disable bidirectional text processing
allConfigure applications to disable FriBidi/bidirectional text support if not needed.
Application-specific configuration; no universal command
Use application sandboxing
linuxRun vulnerable applications with reduced privileges using sandboxing tools.
firejail --noprofile gedit
bwrap --unshare-all --dev /dev --ro-bind /usr /usr --ro-bind /etc /etc gedit
🧯 If You Can't Patch
- Restrict user access to untrusted text sources (files, messages, web content)
- Monitor application crashes and unusual behavior for potential exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check FriBidi version: fribidi --version or dpkg -l | grep fribidi or rpm -q fribidiCheck Version:
fribidi --version 2>/dev/null || dpkg -l | grep fribidi || rpm -q fribidi || pkg-config --modversion fribidiVerify Fix Applied:
Confirm FriBidi version is 1.0.8 or later using version check command📡 Detection & Monitoring
Log Indicators:
- Application crashes (segmentation faults) in FriBidi/Pango-related processes
- Unexpected termination of GNOME/GTK+ applications
Network Indicators:
- Inbound delivery of crafted text files or messages to vulnerable applications
SIEM Query:
Process termination with exit code 11 (SIGSEGV) AND process_name IN ('gedit', 'hexchat', other FriBidi-using apps)🔗 References
- https://access.redhat.com/errata/RHSA-2019:4326
- https://access.redhat.com/errata/RHSA-2019:4361
- https://access.redhat.com/errata/RHSA-2020:0291
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944327
- https://github.com/fribidi/fribidi/commit/034c6e9a1d296286305f4cfd1e0072b879f52568
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFS3N6KKXPI6ATDNEUFRSLX7R6BOBNIP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5UJRTG32FDNI7T637Q6PZYL3UCRR5HR/
- https://marc.info/?l=oss-security&m=157322128105807&w=2
- https://security-tracker.debian.org/tracker/CVE-2019-18397
- https://security.gentoo.org/glsa/202003-41
- https://access.redhat.com/errata/RHSA-2019:4326
- https://access.redhat.com/errata/RHSA-2019:4361
- https://access.redhat.com/errata/RHSA-2020:0291
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944327
- https://github.com/fribidi/fribidi/commit/034c6e9a1d296286305f4cfd1e0072b879f52568
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFS3N6KKXPI6ATDNEUFRSLX7R6BOBNIP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5UJRTG32FDNI7T637Q6PZYL3UCRR5HR/
- https://marc.info/?l=oss-security&m=157322128105807&w=2
- https://security-tracker.debian.org/tracker/CVE-2019-18397
- https://security.gentoo.org/glsa/202003-41
