Every CVE Search/ Get API key

CVE-2015-5297

An integer overflow issue has been reported in the general_composite_rect() function in pixman...

6.7 MediumFix available

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.49%Unchanged since Feb 4, 2022
90%50%10%1%

What each source reports

CVE List Score used 6.7

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
CVE-2015-5297
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2015-5274 6.7

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
EUVD-2015-5274
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-3896-rgxr-mxjp 9.8

An integer overflow issue has been reported in the general_composite_rect() function in pixman...

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
GHSA-3896-rgxr-mxjp
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
NVD 6.7

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
CVE-2015-5297
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
OSV 9.8

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
CVE-2015-5297
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5297 9.8

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
DEBIAN-CVE-2015-5297
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5297 9.8

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

Record
UBUNTU-CVE-2015-5297
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
6.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-3843-1 No score

pixman vulnerability

It was discovered that pixman incorrectly handled the general_composite_rect function. A remote attacker could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-3843-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pixman
Debian:12
before 0.33.4-1
0.33.4-1
pixman
Debian:13
before 0.33.4-1
0.33.4-1
pixman
Debian:14
before 0.33.4-1
0.33.4-1
pixman
Debian:8
before 0.32.6-3+deb8u1, plus listed versions
0.32.6-30.32.6-3+alpha
0.32.6-3+deb8u1
pixman
Ubuntu:14.04:LTS
before 0.30.2-2ubuntu1.2, plus listed versions
0.30.2-10.30.2-20.30.2-2ubuntu10.30.2-2ubuntu1.1
0.30.2-2ubuntu1.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5297 is a medium vulnerability (CVSS 6.7) in Pixman, published December 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in pixman 0.33.4-1.

References

MoveEnter Open