SB2020120416 - openEuler 20.03 LTS update for cairo

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2018-19876)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the cairo_ft_apply_variations() function, as defined in the cairo-ft-font.c source code file due to an error when processing malicious input. A remote attacker can attempt to free memory by using a free function that is incompatible with WebKit's fastMalloc and cause the application to crash, resulting in a DoS condition.

2) Reachable Assertion (CVE-ID: CVE-2019-6461)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in the function _cairo_arc_in_direction in the file cairo-arc.c. A remote attacker can cause the service to crash.

3) Infinite loop (CVE-ID: CVE-2019-6462)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized. A remote attacker can consume all available system resources and cause denial of service conditions.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1099