CVE-2019-6461
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function...
CVE-2019-6461 is a medium vulnerability (CVSS 6.5) in Cairographics Cairo, published January 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in cairo 1.17.6-r4.
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
CVE-2019-6461- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
CVE-2019-6461- Updated
- 2026-11-02
EUVDEUVD-2019-16021 No score
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
EUVD-2019-16021- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pf7q-pwfc-88m3
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function...
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
GHSA-pf7q-pwfc-88m3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVBELL-CVE-2019-6461
- Record
BELL-CVE-2019-6461- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
CVE-2019-6461- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2019-6461
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
DEBIAN-CVE-2019-6461- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2025-15
An issue was discovered in cairo 1.16.0
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
JLSEC-2025-15- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-6461
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
- Record
UBUNTU-CVE-2019-6461- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2019-6461 No score
CVE-2019-6461 in cairo - Patched by Root
Root has patched CVE-2019-6461 in the cairo package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2019-6461- Updated
- 2026-11-02
OSVSUSE-SU-2025:02677-1 No score
Security update for cairo
This update for cairo fixes the following issues:
- CVE-2019-6461: avoid assert when drawing arcs with NaN angles (bsc#1122338).
- Record
SUSE-SU-2025:02677-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03450-1 No score
Security update for cairo
This update for cairo fixes the following issues:
- CVE-2019-6461: Avoid assert when drawing arcs with NaN angles. (bsc#1122338)
- CVE-2025-50422: Fix NULL pointer access in
active_edges_to_traps()leading to crash in Poppler. (bsc#1247589)
- Record
SUSE-SU-2025:03450-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03490-1 No score
Security update for cairo
This update for cairo fixes the following issues:
- CVE-2019-6461: Avoid assert when drawing arcs with NaN angles (bsc#1122338)
- Record
SUSE-SU-2025:03490-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cairoAlpaquita:23 |
1.17.6-r3 up to 1.17.6-r4 | 1.17.6-r4 |
cairoDebian:12 |
All versions, plus listed versions 1.16.0-71.17.8-11.17.8-21.17.8-31.18.0-1 Show 8 moreShow less1.18.0-1~hurd.11.18.0-21.18.0-31.18.2-11.18.2-21.18.4-11.18.4-21.18.4-3 |
None known |
cairoDebian:13 |
before 1.18.0-1 | 1.18.0-1 |
cairoDebian:14 |
before 1.18.0-1 | 1.18.0-1 |
Cairo_jllJulia |
1.16.0+0 up to 1.18.0+0 | 1.18.0+0 |
cairoRoot:Debian:12 |
before 1.16.0-7.root.io.3 | 1.16.0-7.root.io.31.16.0-7.root.io.41.16.0-7.aikido.5 |
rootio-cairoRoot:Debian:12 |
before 1.16.0-7.root.io.3 | 1.16.0-7.root.io.31.16.0-7.root.io.41.16.0-7.aikido.5 |
cairoSUSE:Linux Enterprise Micro 5.3 |
before 1.16.0-150400.11.6.1 | 1.16.0-150400.11.6.1 |
cairoSUSE:Linux Enterprise Micro 5.4 |
before 1.16.0-150400.11.6.1 | 1.16.0-150400.11.6.1 |
cairoSUSE:Linux Enterprise Micro 5.5 |
before 1.16.0-150400.11.6.1 | 1.16.0-150400.11.6.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cairoSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 1.15.2-25.11.1 | 1.15.2-25.11.1 |
cairoSUSE:Linux Enterprise Micro 5.2 |
before 1.16.0-150200.5.11.1 | 1.16.0-150200.5.11.1 |
cairoUbuntu:Pro:16.04:LTS |
before 1.14.6-1ubuntu0.1~esm2, plus listed versions 1.14.2-2ubuntu21.14.4-11.14.6-11.14.6-1ubuntu0.1~esm1 |
1.14.6-1ubuntu0.1~esm2 |
cairoUbuntu:Pro:18.04:LTS |
before 1.15.10-2ubuntu0.1+esm1, plus listed versions 1.14.10-1ubuntu11.15.8-21.15.8-31.15.10-21.15.10-2ubuntu0.1 |
1.15.10-2ubuntu0.1+esm1 |
cairoUbuntu:Pro:20.04:LTS |
before 1.16.0-4ubuntu1+esm1, plus listed versions 1.16.0-41.16.0-4ubuntu1 |
1.16.0-4ubuntu1+esm1 |
cairoUbuntu:22.04:LTS |
before 1.16.0-5ubuntu2.1, plus listed versions 1.16.0-5ubuntu11.16.0-5ubuntu2 |
1.16.0-5ubuntu2.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
gitlab.freedesktop.org/cairo/cairo/issues/352
github.com/TeamSeri0us/pocs/tree/master/gerbv
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-6461
Show 12 moreShow less
docs.bell-sw.com/security/cves/CVE-2019-6461
security-tracker.debian.org/tracker/CVE-2019-6461
suse.com/support/update/announcement/2025/suse-su-202502677-1
bugzilla.suse.com/1122338
ubuntu.com/security/CVE-2019-6461
cve.org/CVERecord?id=CVE-2019-6461