A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cairoUpgrade cairo-develUpgrade cairo-gobjectUpgrade pixmanUpgrade pixman-develUpgrade cairo-gobject-devel | May 13, 2022 | Mar 18, 2021 |
| Alpine Linux | — | Upgrade cairo | Mar 26, 2024 | Mar 18, 2021 |
| Centos_linux | — | Upgrade cairo-debuginfoUpgrade cairo-gobject-debuginfoUpgrade pixman-debugsourceUpgrade pixman-develUpgrade cairo-gobject-develUpgrade cairo-debugsourceUpgrade cairoUpgrade cairo-tools-debuginfoUpgrade cairo-develUpgrade pixmanUpgrade pixman-debuginfoUpgrade cairo-gobject | May 13, 2022 | Mar 18, 2021 |
| Debian | — | Upgrade cairo | Jan 7, 2021 | Jan 7, 2021 |
| Gentoo Linux | — | Upgrade x11-libs/cairo. | May 4, 2023 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cairo-gobjectUpgrade cairo-gobject-develUpgrade cairo-develUpgrade cairo | Sep 16, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cairo-gobjectUpgrade cairo-develUpgrade cairo-gobject-develUpgrade cairo | Apr 30, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cairoUpgrade cairo-gobject-develUpgrade cairo-gobjectUpgrade cairo-devel | Jul 19, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade cairoUpgrade cairo-gobject-develUpgrade cairo-gobjectUpgrade cairo-devel | Jun 28, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade cairo | Jul 2, 2021 | Mar 18, 2021 |
| Oracle Solaris | — | Upgrade library/desktop/cairo to version 1.16.0-11.4.33.0.1.94.0 on Solaris 11.4 | May 19, 2021 | Mar 18, 2021 |
| Oracle_linux | — | Upgrade cairo-develUpgrade cairo-gobjectUpgrade cairo-gobject-develUpgrade pixman-develUpgrade cairoUpgrade pixman | May 18, 2022 | Dec 28, 2020 |
| Redhat_linux | — | No solution existsUpgrade cairo-gobjectUpgrade cairo-gobject-debuginfoUpgrade pixmanUpgrade cairo-develUpgrade pixman-debuginfoUpgrade cairo-debugsourceUpgrade cairo-gobject-develUpgrade cairo-tools-debuginfoUpgrade pixman-debugsourceUpgrade cairoUpgrade pixman-develUpgrade cairo-debuginfo | May 13, 2022 | Mar 18, 2021 |
| Rocky_linux | — | Upgrade cairo-develUpgrade cairo-debugsourceUpgrade pixmanUpgrade cairo-gobjectUpgrade pixman-debuginfoUpgrade pixman-debugsourceUpgrade pixman-develUpgrade cairo-gobject-debuginfoUpgrade cairoUpgrade cairo-gobject-develUpgrade cairo-debuginfo | Mar 5, 2024 | Mar 18, 2021 |
| Ubuntu | — | Upgrade cairo-perf-utils (Ubuntu Pro)Upgrade libcairo2 (Ubuntu Pro) | May 11, 2022 | Mar 18, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub