Bug 2139988 (CVE-2022-44638) - CVE-2022-44638 pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write
Summary: CVE-2022-44638 pixman: Integer overflow in pixman_sample_floor_y leading to h...
Keywords:
Status: NEW
Alias: CVE-2022-44638
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2139996 2139989 2139990 2139991 2139992 2139993 2139994 2139995
Blocks: 2139774
TreeView+ depends on / blocked
 
Reported: 2022-11-04 04:39 UTC by Sandipan Roy
Modified: 2023-07-07 08:32 UTC (History)
15 users (show)

Fixed In Version: Pixman 0.42.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in pixman. This issue causes an out-of-bounds write in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y. This can result in data corruption, a crash, or code execution.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Sandipan Roy 2022-11-04 04:39:48 UTC 
In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.

https://gitlab.freedesktop.org/pixman/pixman/-/issues/63
Comment 1 Sandipan Roy 2022-11-04 04:42:48 UTC 
Created mingw-pixman tracking bugs for this issue:

Affects: fedora-35 [bug 2139989]
Affects: fedora-36 [bug 2139991]


Created pixman tracking bugs for this issue:

Affects: fedora-35 [bug 2139990]
Affects: fedora-36 [bug 2139992]
Note You need to log in before you can comment on or make changes to this bug.