Description
The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cairo | 1.14.2-2 | — |
| Debian 13 | cairo | 1.14.2-2 | — |
| Debian 12 | cairo | 1.14.2-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | atk +1 | 2.14.0-1.el7 | RHBA-2015:2116 |
| RHEL 7 | cairo +4 | 1.14.2-1.el7 | RHBA-2015:2116 |
| RHEL 7 | dconf +2 | 0.22.0-2.el7 | RHBA-2015:2116 |
| RHEL 7 | gdk-pixbuf2 +2 | 2.31.6-3.el7 | RHBA-2015:2116 |
| RHEL 7 | glib2 +3 | 2.42.2-5.el7 | RHBA-2015:2116 |
| RHEL 7 | glibmm24 +3 | 2.42.0-1.el7 | RHBA-2015:2116 |
| RHEL 7 | gobject-introspection +1 | 1.42.0-1.el7 | RHBA-2015:2116 |
| RHEL 7 | gtk2 +4 | 2.24.28-8.el7 | RHBA-2015:2116 |
| RHEL 7 | gtk3 +4 | 3.14.13-16.el7 | RHBA-2015:2116 |
| RHEL 7 | gtksourceview3 +1 | 3.14.3-1.el7 | RHBA-2015:2116 |
| RHEL 7 | harfbuzz +2 | 0.9.36-1.el7 | RHBA-2015:2116 |
| RHEL 7 | json-glib +1 | 1.0.2-1.el7 | RHBA-2015:2116 |
| RHEL 7 | libgsf +1 | 1.14.26-7.el7 | RHBA-2015:2116 |
| RHEL 7 | libnotify +1 | 0.7.5-8.el7 | RHBA-2015:2116 |
| RHEL 7 | libxklavier +1 | 5.4-7.el7 | RHBA-2015:2116 |
| RHEL 7 | mozjs24 +1 | 24.2.0-6.el7 | RHBA-2015:2116 |
| RHEL 7 | orc +3 | 0.4.22-5.el7 | RHBA-2015:2116 |
| RHEL 7 | pango +2 | 1.36.8-2.el7 | RHBA-2015:2116 |
| RHEL 7 | shared-mime-info | 1.1-9.el7 | RHBA-2015:2116 |
| RHEL 7 | webkitgtk3 +3 | 2.4.9-5.el7 | RHBA-2015:2116 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | cairo | 1.12.16-13.1 | SUSE-SU-2016:1100-1 |
| SLES 12 | cairo | 1.12.16-13.1 | SUSE-SU-2016:1100-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | cairo | 1.12.16-13.1 | SUSE-SU-2016:1100-1 |
| SLES for SAP 12 | cairo | 1.12.16-13.1 | SUSE-SU-2016:1100-1 |
Advisories 2
- RHBA-2015:2116 Red Hat Bug Fix Advisory: GTK+ bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- SUSE-SU-2016:1100-1 Security update for cairo SUSE / openSUSE Security Updates · Feb 4, 2026