Vulnerability CVE-2007-5503


Published: 2007-11-29   Modified: 2012-02-12

Description:
Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.

Vendor: Redhat
Product: Cairo 
Version: 1.4.10;

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://bugs.gentoo.org/show_bug.cgi?id=200350
http://bugs.gentoo.org/show_bug.cgi?id=201860
http://gitweb.freedesktop.org/?p=cairo;a=commitdiff;h=5c7d2d14d78e4dfb1ef6d2c40f0910f177e07360
http://gitweb.freedesktop.org/?p=cairo;a=commitdiff;h=e49bcde27f88e21d5b8037a0089a226096f6514b
http://gitweb.freedesktop.org/?p=cairo;a=commitdiff_plain;h=6020f67f1a49cfe3844c4938d4af24c63c8424cc;hp=c79fc9af334fd6f2d1078071d64178125561b187
http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
http://rhn.redhat.com/errata/RHSA-2007-1078.html
http://security.gentoo.org/glsa/glsa-200712-04.xml
http://security.gentoo.org/glsa/glsa-201209-25.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.362119
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0015
http://www.debian.org/security/2008/dsa-1542
http://www.gentoo.org/security/en/glsa/glsa-200712-24.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:019
http://www.securityfocus.com/archive/1/archive/1/486405/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/495869/100/0/threaded
http://www.securityfocus.com/bid/26650
http://www.securitytracker.com/id?1019027
http://www.ubuntulinux.org/support/documentation/usn/usn-550-1
http://www.ubuntulinux.org/support/documentation/usn/usn-550-2
http://www.vmware.com/security/advisories/VMSA-2008-0014.html
http://www.vmware.com/support/player2/doc/releasenotes_player2.html
http://www.vmware.com/support/server/doc/releasenotes_server.html
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
http://www.vupen.com/english/advisories/2007/4045
http://www.vupen.com/english/advisories/2008/2466
https://bugzilla.redhat.com/show_bug.cgi?id=387431
https://exchange.xforce.ibmcloud.com/vulnerabilities/38771
https://issues.rpath.com/browse/RPL-1966
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11251
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00630.html

Related CVE
CVE-2018-1051
It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.
CVE-2018-5748
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.
CVE-2018-1048
It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the ...
CVE-2018-1047
A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
CVE-2017-12197
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive informatio...
CVE-2016-6814
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible f...
CVE-2017-15128
A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13.12. A lack of size check could cause a denial of service (BUG).
CVE-2017-15127
A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlock for VM_SHARED hugetlbfs mapping could trigger a local denial of service (BUG).

Copyright 2018, cxsecurity.com

 

Back to Top