A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cairo-gobject-develUpgrade pixmanUpgrade cairo-gobjectUpgrade cairo-develUpgrade cairoUpgrade pixman-devel | May 13, 2022 | Mar 18, 2021 |
| Alpine Linux | — | Upgrade cairo | Mar 26, 2024 | Mar 18, 2021 |
| Centos_linux | — | Upgrade pixman-develUpgrade cairo-gobject-debuginfoUpgrade cairo-debuginfoUpgrade cairo-debugsourceUpgrade cairoUpgrade cairo-gobject-develUpgrade pixman-debugsourceUpgrade cairo-tools-debuginfoUpgrade cairo-gobjectUpgrade cairo-develUpgrade pixman-debuginfoUpgrade pixman | May 13, 2022 | Mar 18, 2021 |
| Debian | — | Upgrade cairo | Jan 7, 2021 | Jan 7, 2021 |
| Gentoo Linux | — | Upgrade x11-libs/cairo. | May 4, 2023 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cairo-gobjectUpgrade cairo-gobject-develUpgrade cairoUpgrade cairo-devel | Sep 16, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cairo-gobjectUpgrade cairo-develUpgrade cairo-gobject-develUpgrade cairo | Apr 30, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cairo-gobject-develUpgrade cairo-gobjectUpgrade cairo-develUpgrade cairo | Jul 19, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade cairoUpgrade cairo-gobjectUpgrade cairo-develUpgrade cairo-gobject-devel | Jun 28, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade cairo | Jul 2, 2021 | Mar 18, 2021 |
| Oracle Solaris | — | Upgrade library/desktop/cairo to version 1.16.0-11.4.33.0.1.94.0 on Solaris 11.4 | May 19, 2021 | Mar 18, 2021 |
| Oracle_linux | — | Upgrade cairo-gobject-develUpgrade cairo-gobjectUpgrade cairo-develUpgrade cairoUpgrade pixman-develUpgrade pixman | May 18, 2022 | Dec 28, 2020 |
| Redhat_linux | — | Upgrade pixman-debugsourceUpgrade pixman-develUpgrade cairo-gobject-develUpgrade cairo-debugsourceUpgrade cairoUpgrade cairo-tools-debuginfoUpgrade cairo-debuginfoUpgrade cairo-gobjectUpgrade cairo-develUpgrade pixman-debuginfoNo solution existsUpgrade pixmanUpgrade cairo-gobject-debuginfo | May 13, 2022 | Mar 18, 2021 |
| Rocky_linux | — | Upgrade pixman-develUpgrade cairo-debuginfoUpgrade cairo-gobject-develUpgrade cairo-gobject-debuginfoUpgrade cairoUpgrade cairo-develUpgrade pixman-debuginfoUpgrade cairo-gobjectUpgrade cairo-debugsourceUpgrade pixman-debugsourceUpgrade pixman | Mar 5, 2024 | Mar 18, 2021 |
| Ubuntu | — | Upgrade libcairo2 (Ubuntu Pro)Upgrade cairo-perf-utils (Ubuntu Pro) | May 11, 2022 | Mar 18, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub