Skip to content
Fencer Vulns
high 7.8

CVE-2019-18397 json

A buffer overflow in the `fribidi_get_par_embedding_levels_ex()` function in `lib/fribidi-bidi.c` of...

published 2019-11-13 6 y ago modified 2026-07-23 3 mo ago also EUVD-2019-8179 , JLSEC-2025-169

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

Patch / fix

  • julia FriBidi_jll 1.0.10+0
  • fribidi Debian 14, Debian 13, Debian 12 1.0.7-1.1

debian advisories DEBIAN-CVE-2019-18397

  • fribidi RHEL 8 1.0.4-7.el8_1
  • fribidi RHEL 7 1.0.2-1.el7_7.1
  • fribidi RHEL 8.0 E4S 1.0.4-6.el8_0.1

red hat advisories RHSA-2020:0291RHSA-2019:4361RHSA-2019:4326

  • fribidi SLE Module for Desktop Applications 15 SP3, SLE Module for Desktop Applications 15 SP2, SLE Module for Basesystem 15 SP3 +2 more 1.0.5-3.3.1

suse advisories SUSE-SU-2021:1655-1

  • fribidi openSUSE Tumbleweed 1.0.10-2.1
  • fribidi openSUSE Leap 15.3 1.0.5-3.3.1
  • fribidi openSUSE Leap 15.2 1.0.5-lp152.2.3.1

opensuse advisories openSUSE-SU-2024:10772-1openSUSE-SU-2021:1655-1openSUSE-SU-2021:0763-1

  • fribidi Alpine 3.10 1.0.5-r2
  • fribidi Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.0.7-r1
  • fribidi Alpine 3.8 1.0.2-r1
  • fribidi Alpine 3.9 1.0.5-r1

alpine advisories ALPINE-CVE-2019-18397

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-18397 updated cvss 7.8

fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/fribidi-bidi.c leading to denial of service and possible code execution

  • Red Hat Enterprise Linux AppStream (v. 8) fribidi 1.0.4-7.el8_1
    fixed: vendor fix RHSA-2019:4361
  • Red Hat Enterprise Linux AppStream E4S (v. 8.0) fribidi 1.0.4-6.el8_0.1
    fixed: vendor fix RHSA-2020:0291
  • Red Hat Enterprise Linux Client (v. 7) fribidi 1.0.2-1.el7_7.1 Red Hat Enterprise Linux Client Optional (v. 7) fribidi-devel 1.0.2-1.el7_7.1, fribidi-debuginfo 1.0.2-1.el7_7.1 Red Hat Enterprise Linux ComputeNode (v. 7) fribidi 1.0.2-1.el7_7.1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) fribidi-devel 1.0.2-1.el7_7.1, fribidi-debuginfo 1.0.2-1.el7_7.1 Red Hat Enterprise Linux Server (v. 7) fribidi 1.0.2-1.el7_7.1 Red Hat Enterprise Linux Workstation (v. 7) fribidi 1.0.2-1.el7_7.1
    fixed: vendor fix RHSA-2019:4326

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.18% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia FriBidi_jll
<1.0.10+0
1.0.10+0

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.