[SECURITY] [DLA 688-1] cairo security update

2016-10-2819:28:55

lists.debian.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.7 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.2%

JSON

Package : cairo
Version : 1.12.2-3+deb7u1
CVE ID : CVE-2016-9082
Debian Bug : #842289

It was discovered that there was a possible DoS attack in Cairo, a
multi-platform library providing vector-based rendering. An SVG could
generate invalid pointers from a _cairo_image_surface in write_png.

For Debian 7 "Wheezy", this issue has been fixed in cairo version
1.12.2-3+deb7u1.

We recommend that you upgrade your cairo packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8ppc64ellibcairo2-dbg< 1.14.0-2.1+deb8u2libcairo2-dbg_1.14.0-2.1+deb8u2_ppc64el.deb
Debian7amd64libcairo2-dev< 1.12.2-3+deb7u1libcairo2-dev_1.12.2-3+deb7u1_amd64.deb
Debian8i386libcairo-gobject2< 1.14.0-2.1+deb8u2libcairo-gobject2_1.14.0-2.1+deb8u2_i386.deb
Debian8mipslibcairo2< 1.14.0-2.1+deb8u2libcairo2_1.14.0-2.1+deb8u2_mips.deb
Debian7amd64libcairo2< 1.12.2-3+deb7u1libcairo2_1.12.2-3+deb7u1_amd64.deb
Debian7i386libcairo2-dev< 1.12.2-3+deb7u1libcairo2-dev_1.12.2-3+deb7u1_i386.deb
Debian8arm64libcairo2-udeb< 1.14.0-2.1+deb8u2libcairo2-udeb_1.14.0-2.1+deb8u2_arm64.deb
Debian8armhflibcairo-script-interpreter2< 1.14.0-2.1+deb8u2libcairo-script-interpreter2_1.14.0-2.1+deb8u2_armhf.deb
Debian7i386libcairo-gobject2< 1.12.2-3+deb7u1libcairo-gobject2_1.12.2-3+deb7u1_i386.deb
Debian7armelcairo-perf-utils< 1.12.2-3+deb7u1cairo-perf-utils_1.12.2-3+deb7u1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	ppc64el	libcairo2-dbg	< 1.14.0-2.1+deb8u2	libcairo2-dbg_1.14.0-2.1+deb8u2_ppc64el.deb
Debian	7	amd64	libcairo2-dev	< 1.12.2-3+deb7u1	libcairo2-dev_1.12.2-3+deb7u1_amd64.deb
Debian	8	i386	libcairo-gobject2	< 1.14.0-2.1+deb8u2	libcairo-gobject2_1.14.0-2.1+deb8u2_i386.deb
Debian	8	mips	libcairo2	< 1.14.0-2.1+deb8u2	libcairo2_1.14.0-2.1+deb8u2_mips.deb
Debian	7	amd64	libcairo2	< 1.12.2-3+deb7u1	libcairo2_1.12.2-3+deb7u1_amd64.deb
Debian	7	i386	libcairo2-dev	< 1.12.2-3+deb7u1	libcairo2-dev_1.12.2-3+deb7u1_i386.deb
Debian	8	arm64	libcairo2-udeb	< 1.14.0-2.1+deb8u2	libcairo2-udeb_1.14.0-2.1+deb8u2_arm64.deb
Debian	8	armhf	libcairo-script-interpreter2	< 1.14.0-2.1+deb8u2	libcairo-script-interpreter2_1.14.0-2.1+deb8u2_armhf.deb
Debian	7	i386	libcairo-gobject2	< 1.12.2-3+deb7u1	libcairo-gobject2_1.12.2-3+deb7u1_i386.deb
Debian	7	armel	cairo-perf-utils	< 1.12.2-3+deb7u1	cairo-perf-utils_1.12.2-3+deb7u1_armel.deb