Lucene search

K
amazonAmazonALAS-2014-272
HistoryJan 14, 2014 - 3:56 p.m.

Important: pixman

2014-01-1415:56:00
alas.aws.amazon.com
14

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.8%

Issue Overview:

An integer overflow, which led to a heap-based buffer overflow, was found in the way pixman handled trapezoids. If a remote attacker could trick an application using pixman into rendering a trapezoid shape with specially crafted coordinates, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-6425)

Affected Packages:

pixman

Issue Correction:
Run yum update pixman to update your system.

New Packages:

i686:  
    pixman-0.26.2-5.10.amzn1.i686  
    pixman-debuginfo-0.26.2-5.10.amzn1.i686  
    pixman-devel-0.26.2-5.10.amzn1.i686  
  
src:  
    pixman-0.26.2-5.10.amzn1.src  
  
x86_64:  
    pixman-debuginfo-0.26.2-5.10.amzn1.x86_64  
    pixman-0.26.2-5.10.amzn1.x86_64  
    pixman-devel-0.26.2-5.10.amzn1.x86_64  

Additional References

Red Hat: CVE-2013-6425

Mitre: CVE-2013-6425

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.8%