Bug 910149 (CVE-2013-1591)

Summary:	CVE-2013-1591 pixman: stack-based buffer overflow
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ajax, jrusnack, marcandre.lureau, sandmann
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-03-28 03:15:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	910152, 914474, 914477
Bug Blocks:	910151

Description Vincent Danen 2013-02-11 21:59:48 UTC

Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4, has unspecified impact and attack vectors.

The upstream commit to correct this flaw:

http://cgit.freedesktop.org/pixman/commit/?id=de60e2e0e3eb6084f8f14b63f25b3cbfb012943f

The affected code (pixman/pixman-inlines.h, fast_composite_scaled_bilinear()) is present in the version of pixmap shipped with Fedora 17 (0.24.4), but is not present in Red Hat Enterprise Linux 5 or 6 (the fast_composite_scaled_bilinear() function is in pixman/pixman-fast-path.h, but the vulnerable code is not there and I don't detect anything comparable).  So it's likely that the vulnerable code was introduced after 0.22.0.

Comment 1 Vincent Danen 2013-02-11 22:04:06 UTC

Created pixman tracking bugs for this issue

Affects: fedora-all [bug 910152]

Comment 8 Fedora Update System 2013-02-27 02:34:34 UTC

pixman-0.28.0-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2013-03-02 19:53:29 UTC

pixman-0.28.0-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2013-03-27 18:56:35 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0687 https://rhn.redhat.com/errata/RHSA-2013-0687.html

Comment 12 Vincent Danen 2013-04-02 22:26:47 UTC

Statement:

This issue did not affect the versions of pixman as shipped with Red Hat Enterprise Linux 5 as it did not contain the vulnerable code.

Comment 13 errata-xmlrpc 2013-04-23 18:56:30 UTC

This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2013:0746 https://rhn.redhat.com/errata/RHSA-2013-0746.html