In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y. https://gitlab.freedesktop.org/pixman/pixman/-/issues/63
Created mingw-pixman tracking bugs for this issue: Affects: fedora-35 [bug 2139989] Affects: fedora-36 [bug 2139991] Created pixman tracking bugs for this issue: Affects: fedora-35 [bug 2139990] Affects: fedora-36 [bug 2139992]
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2023:7375 https://access.redhat.com/errata/RHSA-2023:7375
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:7386 https://access.redhat.com/errata/RHSA-2023:7386
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:7403 https://access.redhat.com/errata/RHSA-2023:7403
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2023:7531 https://access.redhat.com/errata/RHSA-2023:7531
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:7754 https://access.redhat.com/errata/RHSA-2023:7754
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0131 https://access.redhat.com/errata/RHSA-2024:0131