A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pixmanUpgrade cairoUpgrade pixman-develUpgrade cairo-develUpgrade cairo-gobjectUpgrade cairo-gobject-devel | May 13, 2022 | Mar 18, 2021 |
| Alpine Linux | — | Upgrade cairo | Mar 26, 2024 | Mar 18, 2021 |
| Centos_linux | — | Upgrade pixmanUpgrade cairo-tools-debuginfoUpgrade cairo-develUpgrade pixman-debuginfoUpgrade cairo-gobjectUpgrade pixman-debugsourceUpgrade cairo-gobject-debuginfoUpgrade pixman-develUpgrade cairo-debugsourceUpgrade cairo-gobject-develUpgrade cairoUpgrade cairo-debuginfo | May 13, 2022 | Mar 18, 2021 |
| Debian | — | Upgrade cairo | Jan 7, 2021 | Jan 7, 2021 |
| Gentoo Linux | — | Upgrade x11-libs/cairo. | May 4, 2023 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cairo-gobject-develUpgrade cairoUpgrade cairo-develUpgrade cairo-gobject | Sep 16, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cairoUpgrade cairo-gobject-develUpgrade cairo-develUpgrade cairo-gobject | Apr 30, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cairo-gobjectUpgrade cairo-gobject-develUpgrade cairo-develUpgrade cairo | Jul 19, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade cairo-gobject-develUpgrade cairo-develUpgrade cairo-gobjectUpgrade cairo | Jun 28, 2021 | Mar 18, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade cairo | Jul 2, 2021 | Mar 18, 2021 |
| Oracle Solaris | — | Upgrade library/desktop/cairo to version 1.16.0-11.4.33.0.1.94.0 on Solaris 11.4 | May 19, 2021 | Mar 18, 2021 |
| Oracle_linux | — | Upgrade pixmanUpgrade pixman-develUpgrade cairoUpgrade cairo-gobjectUpgrade cairo-gobject-develUpgrade cairo-devel | May 18, 2022 | Dec 28, 2020 |
| Redhat_linux | — | Upgrade cairoUpgrade cairo-tools-debuginfoUpgrade pixman-debugsourceUpgrade cairo-debugsourceUpgrade pixman-develUpgrade cairo-debuginfoUpgrade cairo-gobject-develUpgrade cairo-gobjectNo solution existsUpgrade cairo-gobject-debuginfoUpgrade pixman-debuginfoUpgrade pixmanUpgrade cairo-devel | May 13, 2022 | Mar 18, 2021 |
| Rocky_linux | — | Upgrade cairo-gobject-debuginfoUpgrade cairo-gobject-develUpgrade cairo-debuginfoUpgrade pixman-develUpgrade cairoUpgrade pixmanUpgrade cairo-debugsourceUpgrade cairo-develUpgrade cairo-gobjectUpgrade pixman-debugsourceUpgrade pixman-debuginfo | Mar 5, 2024 | Mar 18, 2021 |
| Ubuntu | — | Upgrade libcairo2 (Ubuntu Pro)Upgrade cairo-perf-utils (Ubuntu Pro) | May 11, 2022 | Mar 18, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub