CVE-2015-5297
An integer overflow issue has been reported in the general_composite_rect() function in pixman...
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
6.7
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
CVE-2015-5297- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2015-5274
6.7
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
EUVD-2015-5274- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3896-rgxr-mxjp
9.8
An integer overflow issue has been reported in the general_composite_rect() function in pixman...
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
GHSA-3896-rgxr-mxjp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
6.7
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
CVE-2015-5297- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
9.8
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
CVE-2015-5297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5297
9.8
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
DEBIAN-CVE-2015-5297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5297
9.8
An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
- Record
UBUNTU-CVE-2015-5297- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3843-1 No score
pixman vulnerability
It was discovered that pixman incorrectly handled the general_composite_rect function. A remote attacker could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3843-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pixmanDebian:12 |
before 0.33.4-1 | 0.33.4-1 |
pixmanDebian:13 |
before 0.33.4-1 | 0.33.4-1 |
pixmanDebian:14 |
before 0.33.4-1 | 0.33.4-1 |
pixmanDebian:8 |
before 0.32.6-3+deb8u1, plus listed versions 0.32.6-30.32.6-3+alpha |
0.32.6-3+deb8u1 |
pixmanUbuntu:14.04:LTS |
before 0.30.2-2ubuntu1.2, plus listed versions 0.30.2-10.30.2-20.30.2-2ubuntu10.30.2-2ubuntu1.1 |
0.30.2-2ubuntu1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5297 is a medium vulnerability (CVSS 6.7) in Pixman, published December 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in pixman 0.33.4-1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5297
bugs.freedesktop.org/show_bug.cgi?id=92027
nvd.nist.gov/vuln/detail/CVE-2015-5297
github.com/advisories/GHSA-3896-rgxr-mxjp
security-tracker.debian.org/tracker/CVE-2015-5297
ubuntu.com/security/CVE-2015-5297
ubuntu.com/security/notices/USN-3843-1
ubuntu.com/security/notices/USN-3843-2
cve.org/CVERecord?id=CVE-2015-5297