CVE-2018-18064

NameCVE-2018-18064
Descriptioncairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cairo (PTS)jessie1.14.0-2.1+deb8u2vulnerable
stretch1.14.8-1vulnerable
buster, sid1.15.12-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cairosource(unstable)(unfixed)

Notes

https://gitlab.freedesktop.org/cairo/cairo/issues/341

Search for package or bug name: Reporting problems