Security update for cairo SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:1007-1 Final 1 1 2016-04-12T07:08:29Z current 2016-04-12T07:08:29Z 2016-04-12T07:08:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cairo cairo was updated to fix one security issue. This security issue was fixed: - CVE-2016-3190: Out of bounds read in fill_xrgb32_lerp_opaque_spans (bsc#971964). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-updates/2016-04/msg00029.html E-Mail link for openSUSE-SU-2016:1007-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 cairo-1.14.0-7.11.1 cairo-debugsource-1.14.0-7.11.1 cairo-devel-1.14.0-7.11.1 cairo-devel-32bit-1.14.0-7.11.1 cairo-tools-1.14.0-7.11.1 cairo-tools-debuginfo-1.14.0-7.11.1 libcairo-gobject2-1.14.0-7.11.1 libcairo-gobject2-32bit-1.14.0-7.11.1 libcairo-gobject2-debuginfo-1.14.0-7.11.1 libcairo-gobject2-debuginfo-32bit-1.14.0-7.11.1 libcairo-script-interpreter2-1.14.0-7.11.1 libcairo-script-interpreter2-32bit-1.14.0-7.11.1 libcairo-script-interpreter2-debuginfo-1.14.0-7.11.1 libcairo-script-interpreter2-debuginfo-32bit-1.14.0-7.11.1 libcairo2-1.14.0-7.11.1 libcairo2-32bit-1.14.0-7.11.1 libcairo2-debuginfo-1.14.0-7.11.1 libcairo2-debuginfo-32bit-1.14.0-7.11.1 cairo-1.14.0-7.11.1 as a component of openSUSE 13.2 cairo-debugsource-1.14.0-7.11.1 as a component of openSUSE 13.2 cairo-devel-1.14.0-7.11.1 as a component of openSUSE 13.2 cairo-devel-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 cairo-tools-1.14.0-7.11.1 as a component of openSUSE 13.2 cairo-tools-debuginfo-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-gobject2-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-gobject2-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-gobject2-debuginfo-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-gobject2-debuginfo-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-script-interpreter2-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-script-interpreter2-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-script-interpreter2-debuginfo-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo-script-interpreter2-debuginfo-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo2-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo2-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo2-debuginfo-1.14.0-7.11.1 as a component of openSUSE 13.2 libcairo2-debuginfo-32bit-1.14.0-7.11.1 as a component of openSUSE 13.2 The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length. CVE-2016-3190 openSUSE 13.2:cairo-1.14.0-7.11.1 openSUSE 13.2:cairo-debugsource-1.14.0-7.11.1 openSUSE 13.2:cairo-devel-1.14.0-7.11.1 openSUSE 13.2:cairo-devel-32bit-1.14.0-7.11.1 openSUSE 13.2:cairo-tools-1.14.0-7.11.1 openSUSE 13.2:cairo-tools-debuginfo-1.14.0-7.11.1 openSUSE 13.2:libcairo-gobject2-1.14.0-7.11.1 openSUSE 13.2:libcairo-gobject2-32bit-1.14.0-7.11.1 openSUSE 13.2:libcairo-gobject2-debuginfo-1.14.0-7.11.1 openSUSE 13.2:libcairo-gobject2-debuginfo-32bit-1.14.0-7.11.1 openSUSE 13.2:libcairo-script-interpreter2-1.14.0-7.11.1 openSUSE 13.2:libcairo-script-interpreter2-32bit-1.14.0-7.11.1 openSUSE 13.2:libcairo-script-interpreter2-debuginfo-1.14.0-7.11.1 openSUSE 13.2:libcairo-script-interpreter2-debuginfo-32bit-1.14.0-7.11.1 openSUSE 13.2:libcairo2-1.14.0-7.11.1 openSUSE 13.2:libcairo2-32bit-1.14.0-7.11.1 openSUSE 13.2:libcairo2-debuginfo-1.14.0-7.11.1 openSUSE 13.2:libcairo2-debuginfo-32bit-1.14.0-7.11.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-04/msg00029.html https://www.suse.com/security/cve/CVE-2016-3190.html CVE-2016-3190 https://bugzilla.suse.com/971964 SUSE Bug 971964