ID CVE-2007-5503
Summary Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.
References
Vulnerable Configurations
  • cpe:2.3:a:redhat:cairo:1.4.10
    cpe:2.3:a:redhat:cairo:1.4.10
CVSS
Base: 6.8 (as of 30-11-2007 - 14:56)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CAIRO-4961.NASL
    description This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-5503)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 30192
    published 2008-02-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=30192
    title SuSE 10 Security Update : cairo (ZYPP Patch Number 4961)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1542.NASL
    description Peter Valchev (Google Security) discovered a series of integer overflow weaknesses in Cairo, a vector graphics rendering library used by many other applications. If an application uses cairo to render a maliciously crafted PNG image, the vulnerability allows the execution of arbitrary code.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 31948
    published 2008-04-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=31948
    title Debian DSA-1542-1 : libcairo - integer overflow
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20071129_CAIRO_ON_SL5_X.NASL
    description An integer overflow flaw was found in the way Cairo processes PNG images. If an application linked against Cairo processes a malicious PNG image, it is possible to execute arbitrary code as the user running the application. (CVE-2007-5503)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60317
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60317
    title Scientific Linux Security Update : cairo on SL5.x i386/x86_64
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201209-25.NASL
    description The remote host is affected by the vulnerability described in GLSA-201209-25 (VMware Player, Server, Workstation: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details. Impact : Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information. A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console. Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS). Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 62383
    published 2012-10-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62383
    title GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2007-337-01.NASL
    description New cairo packages are available for Slackware 11.0, 12.0, and -current to fix security issues.
    last seen 2018-09-01
    modified 2018-06-27
    plugin id 29189
    published 2007-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29189
    title Slackware 11.0 / 12.0 / current : cairo (SSA:2007-337-01)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2008-0014.NASL
    description I Security Issues a. Setting ActiveX kill bit Starting from this release, VMware has set the kill bit on its ActiveX controls. Setting the kill bit ensures that ActiveX controls cannot run in Internet Explorer (IE), and avoids security issues involving ActiveX controls in IE. See the Microsoft KB article 240797 and the related references on this topic. Security vulnerabilities have been reported for ActiveX controls provided by VMware when run in IE. Under specific circumstances, exploitation of these ActiveX controls might result in denial-of- service or can allow running of arbitrary code when the user browses a malicious Web site or opens a malicious file in IE browser. An attempt to run unsafe ActiveX controls in IE might result in pop-up windows warning the user. Note: IE can be configured to run unsafe ActiveX controls without prompting. VMware recommends that you retain the default settings in IE, which prompts when unsafe actions are requested. Earlier, VMware had issued knowledge base articles, KB 5965318 and KB 9078920 on security issues with ActiveX controls. To avoid malicious scripts that exploit ActiveX controls, do not enable unsafe ActiveX objects in your browser settings. As a best practice, do not browse untrusted Web sites as an administrator and do not click OK or Yes if prompted by IE to allow certain actions. VMware would like to thank Julien Bachmann, Shennan Wang, Shinnai, and Michal Bucko for reporting these issues to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the names CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, CVE-2007-5438, and CVE-2008-3696 to the security issues with VMware ActiveX controls. b. VMware ISAPI Extension Denial of Service The Internet Server Application Programming Interface (ISAPI) is an API that extends the functionality of Internet Information Server (IIS). VMware uses ISAPI extensions in its Server product. One of the ISAPI extensions provided by VMware is vulnerable to a remote denial of service. By sending a malformed request, IIS might shut down. IIS 6.0 restarts automatically. However, IIS 5.0 does not restart automatically when its Startup Type is set to Manual. VMware would like to thank the Juniper Networks J-Security Security Research Team for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2008-3697 to this issue. c. OpenProcess Local Privilege Escalation on Host System This release fixes a privilege escalation vulnerability in host systems. Exploitation of this vulnerability allows users to run arbitrary code on the host system with elevated privileges. VMware would like to thank Sun Bing from McAfee, Inc. for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2008-3698 to this issue. d. Update to Freetype FreeType 2.3.6 resolves an integer overflow vulnerability and other vulnerabilities that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted file. This release updates FreeType to 2.3.7. The Common Vulnerabilities and Exposures Project (cve.mitre.com) has assigned the names CVE-2008-1806, CVE-2008-1807, and CVE-2008-1808 to the issues resolved in Freetype 2.3.6. e. Update to Cairo Cairo 1.4.12 resolves an integer overflow vulnerability that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted PNG file. This release updates Cairo to 1.4.14. The Common Vulnerabilities and Exposures (cve.mitre.com) has assigned the name CVE-2007-5503 to this issue. f. VMware Consolidated Backup (VCB) command-line utilities may expose sensitive information VMware Consolidated Backup command-line utilities accept the user password through the -p command-line option. Users logged into the ESX service console or into the system that runs VCB could gain access to the username and password used by VCB command-line utilities when such commands are running. The ESX patch and the new version of VCB resolve this issue by providing an alternative way of passing the password used by VCB command-line utilities. VCB in ESX ---------- The following options are recommended for passing the password : 1. The password is specified in /etc/backuptools.conf (PASSWORD=xxxxx), and -p is not used in the command line. /etc/backuptools.conf file permissions are read/write only for root. 2. No password is specified in /etc/backuptools.conf and the -p option is not used in the command line. The user will be prompted to enter a password. ESX is not affected unless you use VCB. Stand-alone VCB --------------- The following options are recommended for passing the password : 1. The password is specified in config.js (PASSWORD=xxxxx), and -p is not used in the command line. The file permissions on config.js are read/write only for the administrator. The config.js file is located in folder 'config' of the VCB installation folder. For example, C:\Program Files\Vmware\Vmware Consolidated Backup Framework\config. 2. The password is specified in the registry, and is not specified in config.js, and -p is not used in the command line. Access to the registry key holding the password is allowed only to the administrator. The location of the registry key is : On Windows x86: HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\ VMware Consolidated Backup\Password On Windows x64: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ VMware, Inc.\VMware Consolidated Backup\Password 3. The password is not specified in the registry, and is not specified in config.js, and -p is not used in the command line. The user will be prompted to enter a password. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-2101 to this issue. g. Third-Party Library libpng Updated to 1.2.29 Several flaws were discovered in the way third-party library libpng handled various PNG image chunks. An attacker could create a carefully crafted PNG image file in such a way that it causes an application linked with libpng to crash when the file is manipulated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5269 to this issue. NOTE: There are multiple patches required to remediate the issue. II ESX Service Console rpm updates a. update to bind This update upgrades the service console rpms for bind-utils and bind-lib to version 9.2.4-22.el3. Version 9.2.4.-22.el3 addresses the recently discovered vulnerability in the BIND software used for Domain Name resolution (DNS). VMware doesn't install all the BIND packages on ESX Server and is not vulnerable by default to the reported vulnerability. Of the BIND packages, VMware only ships bind-util and bind-lib in the service console and these components by themselves cannot be used to setup a DNS server. Bind-lib and bind-util are used in client DNS applications like nsupdate, nslookup, etc. VMware explicitly discourages installing applications like BIND on the service console. In case the customer has installed BIND, and the DNS server is configured to support recursive queries, their ESX Server system is affected and they should replace BIND with a patched version. Note: ESX Server will use the DNS server on the network it is on, so it is important to patch that DNS server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-1447 to this issue.
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 40382
    published 2009-07-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40382
    title VMSA-2008-0014 : Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-3818.NASL
    description The latest stable upstream release of cairo fixes a number of memory handling errors, rendering errors, and contains some optimizations. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-05
    plugin id 30024
    published 2008-01-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=30024
    title Fedora 7 : cairo-1.4.14-1.fc7 (2007-3818)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2008-019.NASL
    description Peter Valchev discovered that Cairo did not correctly decode PNG image data. By tricking a user or automated system into processing a specially crafted PNG with Cairo, a remote attacker could execute arbitrary code with the privileges of the user opening the file. The updated packages have been patched to correct this issue.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 36463
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36463
    title Mandriva Linux Security Advisory : cairo (MDVSA-2008:019)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CAIRO-4947.NASL
    description This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-5503)
    last seen 2019-02-21
    modified 2014-06-13
    plugin id 30191
    published 2008-02-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=30191
    title openSUSE 10 Security Update : cairo (cairo-4947)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-1078.NASL
    description Updated Cairo packages that resolve a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Cairo is a vector graphics library designed to provide high-quality display and print output. An integer overflow flaw was found in the way Cairo processes PNG images. If an application linked against Cairo processes a malicious PNG image, it is possible to execute arbitrary code as the user running the application. (CVE-2007-5503) Users of Cairo are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 28368
    published 2007-11-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28368
    title RHEL 5 : cairo (RHSA-2007:1078)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-550-1.NASL
    description Peter Valchev discovered that Cairo did not correctly decode PNG image data. By tricking a user or automated system into processing a specially crafted PNG with Cairo, a remote attacker could execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 29214
    published 2007-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29214
    title Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libcairo vulnerability (USN-550-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200712-04.NASL
    description The remote host is affected by the vulnerability described in GLSA-200712-04 (Cairo: User-assisted execution of arbitrary code) Multiple integer overflows were reported, one of which Peter Valchev (Google Security) found to be leading to a heap-based buffer overflow in the cairo_image_surface_create_from_png() function that processes PNG images. Impact : A remote attacker could entice a user to view or process a specially crafted PNG image file in an application linked against Cairo, possibly leading to the execution of arbitrary code with the privileges of the user running the application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 29291
    published 2007-12-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29291
    title GLSA-200712-04 : Cairo: User-assisted execution of arbitrary code
oval via4
accepted 2013-04-29T04:12:40.867-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.
family unix
id oval:org.mitre.oval:def:11251
status accepted
submitted 2010-07-09T03:56:16-04:00
title te attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.
version 19
redhat via4
advisories
bugzilla
id 387431
title CVE-2007-5503 cairo integer overflow
oval
AND
  • comment Red Hat Enterprise Linux 5 is installed
    oval oval:com.redhat.rhba:tst:20070331001
  • OR
    • AND
      • comment cairo is earlier than 0:1.2.4-3.el5_1
        oval oval:com.redhat.rhsa:tst:20071078002
      • comment cairo is signed with Red Hat redhatrelease key
        oval oval:com.redhat.rhsa:tst:20071078003
    • AND
      • comment cairo-devel is earlier than 0:1.2.4-3.el5_1
        oval oval:com.redhat.rhsa:tst:20071078004
      • comment cairo-devel is signed with Red Hat redhatrelease key
        oval oval:com.redhat.rhsa:tst:20071078005
rhsa
id RHSA-2007:1078
released 2007-11-29
severity Important
title RHSA-2007:1078: cairo security update (Important)
rpms
  • cairo-0:1.2.4-3.el5_1
  • cairo-devel-0:1.2.4-3.el5_1
refmap via4
bid 26650
bugtraq
  • 20080115 rPSA-2008-0015-1 cairo
  • 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.
confirm
debian DSA-1542
fedora FEDORA-2007-3818
fulldisc 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.
gentoo
  • GLSA-200712-04
  • GLSA-200712-24
  • GLSA-201209-25
mandriva MDVSA-2008:019
misc http://bugs.gentoo.org/show_bug.cgi?id=201860
sectrack 1019027
secunia
  • 27775
  • 27819
  • 27880
  • 27887
  • 27985
  • 28289
  • 28476
  • 28529
  • 28555
  • 28838
  • 29767
  • 31707
  • 31711
slackware SSA:2007-337-01
suse SUSE-SR:2008:003
ubuntu
  • USN-550-1
  • USN-550-2
vupen
  • ADV-2007-4045
  • ADV-2008-2466
xf cario-readpng-bo(38771)
Last major update 14-05-2013 - 22:32
Published 29-11-2007 - 20:46
Last modified 15-10-2018 - 17:45
Back to Top