CVE-2014-9766 Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code....
CriticalCVSS 9.8
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pixman(Debian:12) | < 0.32.6-1 | 0.32.6-1 |
| debian/pixman(Debian:13) | < 0.32.6-1 | 0.32.6-1 |
| debian/pixman(Debian:14) | < 0.32.6-1 | 0.32.6-1 |
| pixman | <= 0.32.5 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
References
- Debian Security Tracker CVE-2014-9766 vendor-advisory
- DSA-3525 vendor-advisory
- [oss-security] 20160224 [Pixman] create_bits(): Cast the result of height * stride to size_t mailing-list
- [oss-security] 20160224 Re: [Pixman] create_bits(): Cast the result of height * stride to size_t mailing-list
- www.oracle.com
- USN-2918-1 vendor-advisory
- bugs.freedesktop.org
- bugzilla.redhat.com
- cgit.freedesktop.org
- [Pixman] 20140409 [PATCH] create_bits(): Cast the result of height * stride to size_t mailing-list vendor-advisory
- [xorg-announce] 20140705 [ANNOUNCE] pixman release 0.32.6 now available mailing-list patch vendor-advisory