This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--rKPeb4HPbWSGMuOk7GoXpp6LBG284FGvH
Content-Type: multipart/mixed; boundary="pCuPQpbmAT9dP9nAMeELb8sqmTnp9gUbi"
From: Aaron Bauman
To: gentoo-announce@lists.gentoo.org
Message-ID: <049e6f65-9f2a-f588-4aa3-91b185ae7851@gentoo.org>
Subject: [ GLSA 201612-37 ] Pixman: Buffer overflow
--pCuPQpbmAT9dP9nAMeELb8sqmTnp9gUbi
Content-Type: multipart/alternative;
boundary="------------56B030187C87B9A5F0C2EB3E"
This is a multi-part message in MIME format.
--------------56B030187C87B9A5F0C2EB3E
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201612-37
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Pixman: Buffer overflow
Date: December 13, 2016
Bugs: #561526
ID: 201612-37
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
A buffer overflow in Pixman might allow remote attackers to execute
arbitrary code.
Background
==========
Pixman is a pixel manipulation library.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 x11-libs/pixman < 0.32.8 >= 0.32.8
Description
===========
In pixman-general, careless computations done with the 'dest_buffer'
pointer may overflow, failing the buffer upper limit check.
Impact
======
A remote attacker could possibly cause a Denial of Service condition,
or execute arbitrary code with the privileges of the process.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Pixman users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/pixman-0.32.8"
References
==========
[ 1 ] Pixman 0.32.8 Release Notes
http://lists.x.org/archives/xorg-announce/2015-September/002637.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201612-37
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--------------56B030187C87B9A5F0C2EB3E
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - =
- - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201612-37
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/=
a>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Pixman: Buffer overflow
Date: December 13, 2016
Bugs: #561526
ID: 201612-37
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
=3D=3D=3D=3D=3D=3D=3D=3D
A buffer overflow in Pixman might allow remote attackers to execute
arbitrary code.
Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Pixman is a pixel manipulation library.
Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 x11-libs/pixman < 0.32.8 >=3D 0.=
32.8=20
Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
In pixman-general, careless computations done with the 'dest_buffer'
pointer may overflow, failing the buffer upper limit check.
Impact
=3D=3D=3D=3D=3D=3D
A remote attacker could possibly cause a Denial of Service condition,
or execute arbitrary code with the privileges of the process.
Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
There is no known workaround at this time.
Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
All Pixman users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=3Dx11-libs/pixman-0.32.8"
References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[ 1 ] Pixman 0.32.8 Release Notes
http://lists.x.org/archives=
/xorg-announce/2015-September/002637.html
Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201612-37
Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https=
://bugs.gentoo.org.
License
=3D=3D=3D=3D=3D=3D=3D
Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--------------56B030187C87B9A5F0C2EB3E--
--pCuPQpbmAT9dP9nAMeELb8sqmTnp9gUbi--
--rKPeb4HPbWSGMuOk7GoXpp6LBG284FGvH
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQJ8BAEBCgBmBQJYT5pZXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ1OTcyRDI4NDhFOEE0NDYwRTdERTY4QUM5
RjI4QkQ4QkQxRTM5NUZGAAoJEJ8ovYvR45X/9ckP/2VrXk03e8thscF859KbeIIn
QENCTiGMekFx75Ajdzo/QvuzvMK2Mnj70fc9QyOFTDh8L4trAZ0j6EefGvtTwKfM
6FPKXDDO/H0s432BrFIRzrT17bGjd2ImHBG13Nal23YiFjlJMzEtmTcEx4UdIB1k
Vzk2OmYtnru7A9TioFZR40FEtct9QcblwvDtgSAdh8mYxlRMvinlF/UNYy9I+Ej7
yRPYPwp2hR/D89hmLngMgeeVyKC78rJBpLOU2UG6C/0pbegtT97c60VPrHa5CSp6
6gi9AQ0NjiJBre9BvPNk7Dqv0hxpF+3zkrYBzZUG/qy5ykzwJIBBjOy1cTyynTEB
74MTtGp9pWk0bWknF7tLFH7U//IM2CX99tQ8RvPkdPzEUz4kDTaSvGBaypB/Ye6U
75cHwbmo0XeNOep2iOeEyjn5knkJJvZxvK+T+ZzenpJhyCXSUcKzj/cAx6HCxgV/
TaidkMgxBPvnUmg6ZFJ56cD5ZEZjXCnJXt9DKXCwGCqP22VeLbHaZL4TaucOxrkR
utTVSJIXw9ITPLFgvWnLw04e4w3Mx43CacF12zP/VXuvjCJe0Av1ksHb/e6Pmz1Y
1SiW0aaumKiCBgDb/Om0AGqrtTKf/ihZW3mRV/ReXC1Mr1Ex6z3k01JawdZkHOW6
gJ/kCjfNuyC+9NgepRQQ
=gdGK
-----END PGP SIGNATURE-----
--rKPeb4HPbWSGMuOk7GoXpp6LBG284FGvH--
|