CVE-2016-3190 The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a nega...
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cairo(Debian:12) | < 1.14.2-2 | 1.14.2-2 |
| debian/cairo(Debian:13) | < 1.14.2-2 | 1.14.2-2 |
| debian/cairo(Debian:14) | < 1.14.2-2 | 1.14.2-2 |
| opensuse | = 13.2 | No fix listed |
| cairographics cairo | <= 1.12.16 | No fix listed |
References
- Debian Security Tracker CVE-2016-3190 vendor-advisory
- openSUSE-SU-2016:1007 vendor-advisory
- bugzilla.redhat.com
- cgit.freedesktop.org exploit
- [cairo-announce] 20150310 cairo release 1.14.2 now available mailing-list patch