{"id":"CVE-2018-19876","aliases":["ALPINE-CVE-2018-19876","BELL-CVE-2018-19876","DEBIAN-CVE-2018-19876","EUVD-2018-11550","GHSA-m5xr-7jg3-vh46","JLSEC-2025-14"],"status":"published","title":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free...","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01707,"percentile":0.77451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2018-12-05T20:00:00Z","modified":"2026-10-23T17:17:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"cairo","fixed_in":["1.16.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cairo","fixed_in":["1.16.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cairo","fixed_in":["1.16.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cairo","fixed_in":["1.16.0-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"Cairo_jll","fixed_in":["1.18.0+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-4"}]}]},{"source":"osv","ecosystem":"Julia","package":"Cairo_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0+0"},{"fixed":"1.18.0+0"}]}]}],"products":[{"vendor":"cairographics","product":"cairo"}],"references":[{"url":"https://bugs.webkit.org/show_bug.cgi?id=191595","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19876"},{"url":"https://github.com/advisories/GHSA-m5xr-7jg3-vh46"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-19876","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-19876","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19876","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-19876","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2018-12-05T20:00:00Z","modified":"2026-10-15T17:41:10.806Z","updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2018-11550","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2018-12-05T20:00:00Z","modified":"2026-10-15T17:41:10Z","updated_at":"2026-11-02T17:00:11.403253Z"}],"ghsa":[{"id":"GHSA-m5xr-7jg3-vh46","title":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free...","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2022-05-14T01:37:52Z","modified":"2023-02-02T05:04:23Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:51:51.657093Z"}],"nvd":[{"id":"CVE-2018-19876","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2018-12-05T20:29:00.24Z","modified":"2026-10-15T18:17:18.247Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:49.995593Z"}],"osv":[{"id":"ALPINE-CVE-2018-19876","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2018-12-05T20:29:00.24Z","modified":"2026-10-23T17:17:55.239859947Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-19876","title":"CVE-2018-19876 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:11.981208Z","modified":"2026-01-26T09:47:51.910979Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-19876","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2018-12-05T20:29:00.24Z","modified":"2026-03-15T22:25:55.19934Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19876","description":"cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2018-12-05T20:29:00.24Z","modified":"2026-10-15T21:47:32.594116558Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"JLSEC-2025-14","title":"cairo 1.16.0, in `cairo_ft_apply_variations()` in cairo-ft-font.c, would free memory using a free...","description":"cairo 1.16.0, in `cairo_ft_apply_variations()` in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.","status":"published","published":"2025-10-10T13:22:08.213Z","modified":"2026-07-23T22:30:09.935965105Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"}]}}