SB2024071245 - SUSE update for cairo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024071245

SB2024071245 - SUSE update for cairo

Published: July 12, 2024

Security Bulletin ID SB2024071245
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Infinite loop (CVE-ID: CVE-2019-6462)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized. A remote attacker can consume all available system resources and cause denial of service conditions.


2) Denial of service (CVE-ID: CVE-2016-6358)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to input validation flaw. By connecting to the FTP service and sending a specially crafted parameters, a remote attacker can trigger the target FTP service to crash.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Remediation

Install update from vendor's website.

References