CVE-2017-9814

cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.

cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call.

cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call. (CVE-2017-9814)

This update for cairo fixes the following issues:

• Fix a memory corruption in pango.
• Revert 'Correctly decode Adobe CMYK JPEGs in PDF export'.
• Add more FreeeType font color conversions to support COLR/CPAL.
• Fix crash when rendering Microsoft's Segoe UI Emoji Regular font.
• Fix memory leaks found by Coverity.
• Fix assertion failure in the freetype backend. (fdo#105746).
• Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (bsc#1049092)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the cairo-devel-1.16.0-3.14 package on the GA media of openSUSE Tumbleweed.

This update for cairo fixes the following issues:

• CVE-2017-9814: out-of-bounds read in cairo-truetype-subset.c could lead to denial of service (bsc#1049092).

This update for cairo fixes the following issues:

• CVE-2016-9082: Fixed a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255).
• CVE-2017-9814: Replace malloc with _cairo_malloc and check cmap size before allocating to prevent DoS (bsc#1049092).
• CVE-2017-7475: Fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789).

This update for cairo fixes the following issues:

The following security vulnerability was addressed:

• CVE-2017-9814: Fixed and out-of-bounds read in cairo-truetype-subset.c by replacing the malloc implementation with _cairo_malloc and checking the size before memory allocation (bsc#1049092)

This update for cairo fixes the following issues:

• Fix a memory corruption in pango.
• Revert 'Correctly decode Adobe CMYK JPEGs in PDF export'.
• Add more FreeeType font color conversions to support COLR/CPAL.
• Fix crash when rendering Microsoft's Segoe UI Emoji Regular font.
• Fix memory leaks found by Coverity.
• Fix assertion failure in the freetype backend. (fdo#105746).
• Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (bsc#1049092)

Gustavo Grieco, Alberto Garcia, Francisco Oca, Suleman Ali, and others discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-9082, CVE-2017-9814, CVE-2019-6462)

Stephan Bergmann discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2020-35492)

Alberto Garcia, Francisco Oca and Suleman Ali discovered that Cairo did not properly manage memory. An attacker could possibly use this issue to cause Cairo to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2017-9814)

It was discovered that Cairo incorrectly handled certain angle values when drawing arcs. An attacker could possibly use this issue to cause Cairo to crash, resulting in a denial of service. (CVE-2019-6461)

It was discovered that Cairo incorrectly handled certain calculations when drawing arcs. An attacker could possibly use this issue to cause Cairo to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2019-6462)

Stephan Bergmann discovered that Cairo incorrectly managed memory during image composition. An attacker could use this issue to cause Cairo to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35492)