SB2017062119 - Denial of service in Cairo

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-9814)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in cairo-truetype-subset.c due to out-of-bounds read because of mishandling of an unexpected malloc(0) call. A remote attacker can cause the service to crash.

2) Null pointer dereference (CVE-ID: CVE-2017-7475)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph. A remote attacker can send specially crafted input and cause the service to crash.

3) Integer overflow (CVE-ID: CVE-2016-9082)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow in the write_png function. A remote attacker can send a specially crafted large svg file, trigger invalid pointer dereference and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://bugs.freedesktop.org/show_bug.cgi?id=101547
• http://seclists.org/oss-sec/2017/q2/151
• http://www.openwall.com/lists/oss-security/2016/10/27/2