A vulnerability has been discovered in Pixman, which can lead to a heap buffer overflow.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-libs/pixman | * | < 0.42.2 | >= 0.42.2 |
Pixman is a pixel manipulation library.
A vulnerability has been discovered in Pixman. Please review the CVE identifiers referenced below for details.
An out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 can occur due to an integer overflow in pixman_sample_floor_y.
There is no known workaround at this time.
All Pixman users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/pixman-0.42.2"
A buffer overflow in Pixman might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-libs/pixman | * | < 0.32.8 | >= 0.32.8 |
Pixman is a pixel manipulation library.
In pixman-general, careless computations done with the ‘dest_buffer’ pointer may overflow, failing the buffer upper limit check.
A remote attacker could possibly cause a Denial of Service condition, or execute arbitrary code with the privileges of the process.
There is no known workaround at this time.
All Pixman users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/pixman-0.32.8"
An integer underflow vulnerability in Pixman may allow a context-dependent attacker to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-libs/pixman | * | < 0.32.4 | >= 0.32.4 |
Pixman is a pixel manipulation library.
The trapezoid handling code in Pixman contains an integer underflow vulnerability.
A context-dependent attacker could entice a user to open a specially crafted file using an application linked against Pixman, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition.
There is no known workaround at this time.
All Pixman users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/pixman-0.32.4"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.