{"id":"CVE-2020-35492","aliases":["ALPINE-CVE-2020-35492","ALSA-2022:1961","BELL-CVE-2020-35492","CLSA-2026-1787645764","DEBIAN-CVE-2020-35492","DLA-2518-1","EUVD-2020-23161","GHSA-65pg-7gjm-q28m","JLSEC-2025-17","MGASA-2021-0028","OESA-2021-1155","RHSA-2022:1961","RLSA-2022:1961","UBUNTU-CVE-2020-35492","USN-5407-1"],"status":"published","title":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows...","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01016,"percentile":0.63589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2021-01-06T00:00:00Z","modified":"2026-10-29T11:01:17Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"cairo","fixed_in":["1.16.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"cairo","fixed_in":["1.16.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"cairo","fixed_in":["1.16.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cairo","fixed_in":["1.16.0-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cairo","fixed_in":["1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cairo-devel","fixed_in":["1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cairo-gobject","fixed_in":["1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cairo-gobject-devel","fixed_in":["1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pixman","fixed_in":["0.38.4-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pixman-devel","fixed_in":["0.38.4-2.el8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"cairo-perf-utils","fixed_in":["1.15.10-2ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo-gobject2","fixed_in":["1.15.10-2ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo-script-interpreter2","fixed_in":["1.15.10-2ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo2","fixed_in":["1.15.10-2ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo2-dev","fixed_in":["1.15.10-2ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo2-doc","fixed_in":["1.15.10-2ubuntu0.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cairo","fixed_in":["1.16.0-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cairo","fixed_in":["1.16.0-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cairo","fixed_in":["1.16.0-5"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"cairo","fixed_in":["1.14.8-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Cairo_jll","fixed_in":["1.18.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"cairo","fixed_in":["1.16.0-2.2.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"cairo","fixed_in":["1.16.0-3.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-debuginfo","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-debugsource","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-devel","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-gobject","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-gobject-debuginfo","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-gobject-devel","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-tools-debuginfo","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pixman","fixed_in":["0:0.38.4-2.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cairo","fixed_in":["0:1.15.12-6.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cairo","fixed_in":["1.14.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cairo","fixed_in":["1.15.10-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cairo","fixed_in":["1.16.0-4ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cairo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cairo-gobject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cairo-gobject-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pixman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.4-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pixman-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.38.4-2.el8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"cairo-perf-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo-gobject2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo-script-interpreter2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libcairo2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-5"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.8-1+deb9u1"}]}],"versions":["1.14.8-1"]},{"source":"osv","ecosystem":"Julia","package":"Cairo_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-2.2.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-3.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-gobject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-gobject-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-gobject-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cairo-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pixman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.38.4-2.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.12-6.el8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-1ubuntu0.1~esm1"}]}],"versions":["1.14.2-2ubuntu2","1.14.4-1","1.14.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2ubuntu0.1+esm1"}]}],"versions":["1.14.10-1ubuntu1","1.15.8-2","1.15.8-3","1.15.10-2","1.15.10-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-4ubuntu1+esm1"}]}],"versions":["1.16.0-4","1.16.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-1ubuntu0.1~esm1"}]}],"versions":["1.14.2-2ubuntu2","1.14.4-1","1.14.6-1"],"bundled":4}],"products":[{"vendor":"cairographics","product":"cairo"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898396","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.gentoo.org/glsa/202305-21","tags":["x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35492","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/cairo/cairo/-/commit/03a820b173ed1fdef6ff14b4468f5dbc02ff59be"},{"url":"https://access.redhat.com/errata/RHSA-2022:1961","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-35492","tags":["report"]},{"url":"https://github.com/advisories/GHSA-65pg-7gjm-q28m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-35492","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1961.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-35492","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-35492","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787645764.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35492","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0028.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28084","tags":["report"]},{"url":"https://www.debian.org/lts/security/2021/dla-2518","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1155","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1961.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35492","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1961","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35492","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5407-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8140-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6462","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-35492","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T18:59:41Z","modified":"2025-02-13T16:27:43.741Z","cwes":["CWE-121"],"updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23161","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T18:59:41Z","modified":"2025-02-13T16:27:43Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-65pg-7gjm-q28m","title":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows...","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2022-05-24T17:44:47Z","modified":"2023-05-03T12:30:22Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:54:34.500941Z"}],"nvd":[{"id":"CVE-2020-35492","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T19:15:13.23Z","modified":"2026-06-17T03:13:48.247Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"ALPINE-CVE-2020-35492","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T19:15:13.23Z","modified":"2026-10-26T11:17:55.171963923Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-35492","title":"CVE-2020-35492 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:10.652556Z","modified":"2026-01-26T09:48:31.505784Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-35492","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T19:15:13.23Z","modified":"2026-04-16T04:35:29.180041839Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35492","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T19:15:13.23Z","modified":"2026-10-26T12:02:48.858356919Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"JLSEC-2025-17","title":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2025-10-10T13:22:08.213Z","modified":"2026-07-18T00:00:53.697666028Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2021-1155","title":"cairo security update","description":"\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in cairo\u0026apos;s image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo\u0026apos;s image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u0026gt; out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-35492)","status":"published","published":"2021-05-06T11:04:23Z","modified":"2026-08-18T01:15:28.183686263Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:1961","title":"Red Hat Security Advisory: cairo and pixman security and bug fix update","status":"published","published":"2024-09-16T07:28:53Z","modified":"2026-06-27T10:15:02Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1961","title":"Moderate: cairo and pixman security and bug fix update","description":"Cairo is a 2D graphics library designed to provide high-quality display and print output.\n\nPixman is a pixel manipulation library for the X Window System and Cairo.\n\nSecurity Fix(es):\n\n* cairo: libreoffice slideshow aborts with stack smashing in cairo's composite_boxes (CVE-2020-35492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:09:42Z","modified":"2026-02-04T20:30:10.92858Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2020-35492","description":"A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -\u003e out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-03-18T19:15:00Z","modified":"2026-04-22T12:39:14.34033Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"ALSA-2022:1961","title":"Moderate: cairo and pixman security and bug fix update","description":"Cairo is a 2D graphics library designed to provide high-quality display and print output.\n\nPixman is a pixel manipulation library for the X Window System and Cairo.\n\nSecurity Fix(es):\n\n* cairo: libreoffice slideshow aborts with stack smashing in cairo's composite_boxes (CVE-2020-35492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:09:42Z","modified":"2026-10-29T11:01:17.788859219Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1787645764","title":"Fix CVE(s): CVE-2020-35492","description":"   * SECURITY UPDATE: stack-based buffer overflow in the image compositor\n     - debian/patches/CVE-2020-35492.patch: in _inplace_src_spans() in\n       src/cairo-image-compositor.c, take the mask write pointer from\n       pixman_image_get_data(r-\u003emask) instead of the r-\u003e_buf tail of the\n       stack-allocated span renderer, so a row wider than SZ_BUF (whose\n       mask pixman already backs with a heap allocation) can no longer be\n       written past the end of the stack buffer.\n     - CVE-2020-35492","status":"published","published":"2026-08-25T08:16:15Z","modified":"2026-10-26T09:31:34.051413653Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"DLA-2518-1","title":"cairo - security update","status":"published","published":"2021-01-06T00:00:00Z","modified":"2026-03-09T01:21:18.88646Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0028","title":"Updated cairo packages fix a security vulnerability","description":"LibreOffice slideshow aborts with stack smashing in cairo’s composite_boxes\n(CVE-2020-35492).\n","status":"published","published":"2021-01-14T15:13:25Z","modified":"2026-04-16T04:40:43.429662417Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-5407-1","title":"cairo vulnerabilities","description":"Gustavo Grieco, Alberto Garcia, Francisco Oca, Suleman Ali, and others\ndiscovered that Cairo incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2016-9082, CVE-2017-9814, CVE-2019-6462)\n\nStephan Bergmann discovered that Cairo incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service,\nor possibly execute arbitrary code.\n(CVE-2020-35492)\n","status":"published","published":"2022-05-10T14:15:51Z","modified":"2026-06-25T13:31:10.507053709Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}