Bugzilla – Bug 815064
VUL-0: CVE-2013-1591: pixman: Stack-based buffer overflow
Last modified: 2014-06-17 05:35:17 UTC
Hi. There is a security bug in package 'libpixman-1-0'. This information is from 'full-disclosure'. This bug is public. There is no coordinated release date (CRD) set. CVE number: CVE-2013-1591 CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1591 CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P) Buffer Errors (CWE-119) Original posting: -------- Original-Nachricht -------- Betreff: [Full-disclosure] [ MDVSA-2013:116 ] pixman Datum: Wed, 10 Apr 2013 15:08:00 +0200 Von: security@mandriva.com Antwort an: noreply@mandriva.com An: full-disclosure@lists.grok.org.uk _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:116 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : pixman Date : April 10, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated pixman packages fix security vulnerability: Stack-based buffer overflow in libpixman has unspecified impact and attack vectors (CVE-2013-1591). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1591 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0077 _______________________________________________________________________ Updated Packages: ...
bugbot adjusting priority
RedHat reference: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1591
We found this issue in pixman-0.24.4 inside the SLE11-SP3 channel. http://cgit.freedesktop.org/pixman/commit/?id=de60e2e0e3eb6084f8f14b63f25b3cbfb012943f SLE-11 SP2 is not affected (Version 0.16.0).
HPJ - can you take this...
The SWAMPID for this issue is 53650. This issue was rated as important. Please submit fixed packages until 2013-07-25. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
The SWAMPID for this issue is 53651. This issue was rated as important. Please submit fixed packages until 2013-07-25. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
please include fix for the evince pdf hang, bug 818242
ping? deadline today?
Took this since hpj is on vacation. I've just submitted a patch; SR#27874.
Update released for: libpixman-1-0, libpixman-1-0-32bit, libpixman-1-0-devel, libpixman-1-0-x86, pixman, pixman-debuginfo, pixman-debugsource Products: SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP3 (i386, x86_64) SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP3 (i386, x86_64)
on opensuse pixman is maintained by gnome maintainers, reassign ... please check if pixman is affected there , thanks
SR#196566 for openSUSE:12.2 openSUSE:12.3 is not affected as it shipped the already fixed upstream version 0.28.2
This is an autogenerated message for OBS integration: This bug (815064) was mentioned in https://build.opensuse.org/request/show/196566 Maintenance /
Appears fixes are submitted for all platforms...
openSUSE-SU-2013:1421-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 815064 CVE References: CVE-2013-1519,CVE-2013-1591 Sources used: openSUSE 12.2 (src): pixman-0.24.4-4.4.1
Closing as fixed.