SB2017062119 - Denial of service in Cairo

Description

This security bulletin contains information about 3 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-9814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in cairo-truetype-subset.c due to out-of-bounds read because of mishandling of an unexpected malloc(0) call. A remote attacker can cause the service to crash.

2) Null pointer dereference (CVE-ID: CVE-2017-7475)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph. A remote attacker can send specially crafted input and cause the service to crash.

3) Integer overflow (CVE-ID: CVE-2016-9082)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow in the write_png function. A remote attacker can send a specially crafted large svg file, trigger invalid pointer dereference and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://bugs.freedesktop.org/show_bug.cgi?id=101547
• http://seclists.org/oss-sec/2017/q2/151
• http://www.openwall.com/lists/oss-security/2016/10/27/2