Bug 910149 (CVE-2013-1591)

Summary: CVE-2013-1591 pixman: stack-based buffer overflow
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ajax, jrusnack, marcandre.lureau, sandmann
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20120915,reported=20130211,source=debian,cvss2=6.5/AV:N/AC:L/Au:S/C:P/I:P/A:P,fedora-all/pixman=affected,rhel-6/pixman=affected,rhel-5/pixman=notaffected,cwe=CWE-121
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-27 23:15:55 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 910152, 914474, 914477    
Bug Blocks: 910151    

Description Vincent Danen 2013-02-11 16:59:48 EST
Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4, has unspecified impact and attack vectors.

The upstream commit to correct this flaw:


The affected code (pixman/pixman-inlines.h, fast_composite_scaled_bilinear()) is present in the version of pixmap shipped with Fedora 17 (0.24.4), but is not present in Red Hat Enterprise Linux 5 or 6 (the fast_composite_scaled_bilinear() function is in pixman/pixman-fast-path.h, but the vulnerable code is not there and I don't detect anything comparable).  So it's likely that the vulnerable code was introduced after 0.22.0.
Comment 1 Vincent Danen 2013-02-11 17:04:06 EST
Created pixman tracking bugs for this issue

Affects: fedora-all [bug 910152]
Comment 8 Fedora Update System 2013-02-26 21:34:34 EST
pixman-0.28.0-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-03-02 14:53:29 EST
pixman-0.28.0-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 errata-xmlrpc 2013-03-27 14:56:35 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0687 https://rhn.redhat.com/errata/RHSA-2013-0687.html
Comment 12 Vincent Danen 2013-04-02 18:26:47 EDT

This issue did not affect the versions of pixman as shipped with Red Hat Enterprise Linux 5 as it did not contain the vulnerable code.
Comment 13 errata-xmlrpc 2013-04-23 14:56:30 EDT
This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2013:0746 https://rhn.redhat.com/errata/RHSA-2013-0746.html