PT-2020-6179 · Cairo+8 · Cairo+8

Published 2020-12-02 · Updated 2026-04-02 · CVE-2020-35492

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cairo versions prior to 1.17.4

Description A flaw was found in cairo's image-compositor.c, allowing an attacker who can provide a crafted input file to cause a stack buffer overflow, resulting in an out-of-bounds WRITE. This can lead to confidentiality, integrity, and system availability issues. The attacker can exploit this by convincing a user to open a crafted file in an application using cairo or if an application uses cairo on untrusted input.

Recommendations For versions prior to 1.17.4, update to version 1.17.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of cairo's image-compositor.c on untrusted input until a patch is available. Avoid using cairo on untrusted input files to minimize the risk of exploitation.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

ALSA-2022:1961

ALT-PU-2022-3396

ALT-PU-2023-1002

ALT-PU-2023-1010

ALT-PU-2023-4111

ALT-PU-2023-8411

BDU:2021-03445

CESA-2022_1961

CVE-2020-35492

DLA-2518-1

MGASA-2021-0028

OESA-2021-1155

RHSA-2022:1961

RHSA-2022_1961

RLSA-2022:1961

USN-5407-1

USN-8140-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Ubuntu

Cairo

References · 48

• https://errata.almalinux.org/8/ALSA-2022-1961.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9814 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35492 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35492 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03445 · Security Note
• https://ubuntu.com/security/CVE-2019-6462 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35492 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2518-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:1961 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:1961 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:1961 · Vendor Advisory