PT-2015-6837 · None+2 · Pixman+2

Stefan Cornelius · Published 2015-11-15 · Updated 2019-10-09 · CVE-2015-5297

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pixman versions prior to 0.32.8

Description An integer overflow issue has been reported in the general composite rect() function. This issue could be exploited by an attacker to cause an application using pixman to crash or potentially execute arbitrary code.

Recommendations For versions prior to 0.32.8, update to version 0.32.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the general composite rect() function until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2015-1997

CVE-2015-5297

DLA-1587-1

USN-3843-1

USN-3843-2

Affected Products

Alt Linux

Ubuntu

Pixman

References · 21

• 🔥 https://bugs.freedesktop.org/show_bug.cgi?id=92027 · Exploit
• https://osv.dev/vulnerability/CVE-2015-5297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5297 · Security Note
• https://osv.dev/vulnerability/DLA-1587-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3843-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5297 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5297 · Security Note
• https://security-tracker.debian.org/tracker/source-package/pixman · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5297 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5297 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-5297 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1997 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5297 · Patch
• https://osv.dev/vulnerability/USN-3843-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1587-1 · Vendor Advisory