Joined: 12 May 2004
|Posted: Sun Feb 02, 2014 10:32 pm Post subject: [ GLSA 201402-03 ] Pixman: User-assisted execution of arbitr
|Gentoo Linux Security Advisory
Title: Pixman: User-assisted execution of arbitrary code (GLSA 201402-03)
Exploitable: local, remote
Date: February 02, 2014
An integer underflow vulnerability in Pixman may allow a
context-dependent attacker to cause Denial of Service.
Pixman is a pixel manipulation library.
Vulnerable: < 0.32.4
Unaffected: >= 0.32.4
Architectures: All supported architectures
The trapezoid handling code in Pixman contains an integer underflow
A context-dependent attacker could entice a user to open a specially
crafted file using an application linked against Pixman, possibly
resulting in execution of arbitrary code with the privileges of the
process, or a Denial of Service condition.
There is no known workaround at this time.
All Pixman users should upgrade to the latest version:
Packages which depend on this library may need to be recompiled. Tools
|# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/pixman-0.32.4"
such as revdep-rebuild may assist in identifying these packages.
Last edited by GLSA on Thu Apr 17, 2014 4:33 am; edited 2 times in total