CVE-2016-9082

Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg file.

It was discovered that there was a possible DoS attack in Cairo. An SVG could generate invalid pointers from a _cairo_image_surface in write_png (CVE-2016-9082).

These are all security issues fixed in the cairo-devel-1.16.0-3.14 package on the GA media of openSUSE Tumbleweed.

This update for cairo fixes the following issues:

• CVE-2017-7475: Fixed a segfault in get_bitmap_surface due to malformed font (bsc#1036789).
• CVE-2016-9082: fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255).

This update for cairo fixes the following issues:

• CVE-2016-9082: Fixed a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255).
• CVE-2017-9814: Replace malloc with _cairo_malloc and check cmap size before allocating to prevent DoS (bsc#1049092).
• CVE-2017-7475: Fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789).

Gustavo Grieco, Alberto Garcia, Francisco Oca, Suleman Ali, and others discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-9082, CVE-2017-9814, CVE-2019-6462)

Stephan Bergmann discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2020-35492)