PT-2019-6389 · Cairo+5 · Cairo+5

Published 2019-01-09 · Updated 2026-04-02 · CVE-2019-6462

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cairo version 1.16.0

Description The issue is related to an infinite loop in the arc error normalized function in the cairo-arc.c file of the Cairo vector graphics library. This loop has an unreachable exit condition. Exploitation of this issue could allow a remote attacker to cause a denial of service.

Recommendations For Cairo version 1.16.0, consider disabling the arc error normalized function as a temporary workaround until a patch is available. Restrict access to the cairo-arc.c file to minimize the risk of exploitation. Avoid using the arc max angle for tolerance normalized related functionality in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2023-4111

ALT-PU-2023-8411

BDU:2023-07615

CVE-2019-6462

ECHO-CF8C-C1D6-F73D

MGASA-2021-0497

OPENSUSE-SU-2024_1704-1

ROSA-SA-2024-2447

SUSE-SU-2021:3502-1

SUSE-SU-2021_3502-1

SUSE-SU-2024:1704-1

SUSE-SU-2024:1704-2

SUSE-SU-2024_1704-1

SUSE-SU-2025:02795-1

USN-5407-1

USN-8140-1

Affected Products

Alt Linux

Astra Linux

Cairo

Debian

Suse

Ubuntu

References · 40

• 🔥 https://github.com/TeamSeri0us/pocs/tree/master/gerbv · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2024:1704-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9814 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-6462 · Security Note
• https://ubuntu.com/security/CVE-2020-35492 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0497.html · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-6462 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6462 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6461 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02795-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8140-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6462 · Security Note
• https://osv.dev/vulnerability/USN-5407-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6462 · Vendor Advisory