CVE-2016-3190

Name	CVE-2016-3190
Description	The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cairo (PTS)	bullseye	1.16.0-5	fixed
	bookworm	1.16.0-7	fixed
	forky, sid, trixie	1.18.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cairo	source	jessie	1.14.0-2.1+deb8u1
cairo	source	(unstable)	1.14.2-2

Notes

[wheezy] - cairo <no-dsa> (Minor issue)
https://cgit.freedesktop.org/cairo/patch/src/cairo-image-compositor.c?id=5c82d91a5e15d29b1489dcb413b24ee7fdf59934