CVE-2020-37011
Heap Corruption in Gnome Fonts Viewer 3.34.0 Causes Crash
Publication date: 2026-01-29
Last updated on: 2026-01-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnome | fonts_viewer | 3.34.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap corruption issue in Gnome Fonts Viewer version 3.34.0. It occurs when the application processes a specially crafted TrueType Font (TTF) file containing an oversized pattern. This malformed TTF file causes an out-of-bounds write and triggers an infinite malloc() memory allocation loop, which leads to heap corruption and can crash the gnome-font-viewer process. [3, 4]
How can this vulnerability impact me? :
The vulnerability can cause the gnome-font-viewer process to crash due to heap corruption triggered by the malicious TTF file. This can result in a denial-of-service condition, potentially freezing the operating system. The attack requires local access and user interaction to open the malicious font file. [3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying the presence of Gnome Fonts Viewer version 3.34.0 on your system and monitoring for crashes or hangs of the gnome-font-viewer process when opening TTF font files. Since the exploit involves opening a specially crafted TTF file that triggers an infinite malloc() loop, detection can include checking for abnormal behavior or crashes of the gnome-font-viewer application. There are no specific network detection commands provided. On the system, you can check the installed version of gnome-font-viewer using commands like 'gnome-font-viewer --version' or 'dpkg -l | grep gnome-font-viewer' on Debian-based systems. Monitoring process behavior with tools like 'top', 'htop', or 'ps' for gnome-font-viewer hangs or crashes when opening font files may help detect exploitation attempts. [3, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding opening untrusted or suspicious TTF font files with Gnome Fonts Viewer version 3.34.0, as the vulnerability requires local user interaction to trigger. Restrict local access to systems with this vulnerable version installed. If possible, update or patch the gnome-font-viewer application to a version that addresses this heap corruption vulnerability. If no patch is available, consider removing or disabling gnome-font-viewer until a fix is released. Additionally, monitor for any abnormal application behavior and educate users about the risks of opening untrusted font files. [3, 4]