=========================================================== Ubuntu Security Notice USN-265-1 March 23, 2006 libcairo vulnerability CVE-2006-0528 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 5.10 (Breezy Badger) The following packages are affected: libcairo2 The problem can be corrected by upgrading the affected package to version 1.0.2-0ubuntu1.1. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: When rendering glyphs, the cairo graphics rendering library did not check the maximum length of character strings. A request to display an excessively long string with cairo caused a program crash due to an X library error. Mike Davis discovered that this could be turned into a Denial of Service attack in Evolution. An email with an attachment with very long lines caused Evolution to crash repeatedly until that email was manually removed from the mail folder. This only affects Ubuntu 5.10. Previous Ubuntu releases did not use libcairo for text rendering.
this seems to be http://bugzilla.gnome.org/show_bug.cgi?id=328937 and it appears to crash gedit too Changelog entry taken from ubuntu diff: + * SECURITY UPDATE: Fix crash with applications that render untrusted text + with cairo. + * Add debian/patches/01_break_up_glyph_rendering.patch: + - _cairo_xlib_surface_show_glyphs(): Break up rendering into chunks to fit + into X max request length protocol limits. + - This fixes crashes in e. g. Evolution with inline attachments with + overly long lines. + - Patch backported from upstream git + http://gitweb.freedesktop.org/?p=cairo;a=commit;h=3370cd631858cac0fd3ce3 3c74db3af40991e6f1 + * CVE-2006-0528 -- this is at max a very minor security issue anyways, CC'ing maintainers not setting status yet
Ccing gnome herd as cardoe doesn't answer. Please patch or advise.
gnome is in metadata, should've been added when this got opened. Cairo-1.0.4 contains the fix for this and since it is mainly a bugfix release and there have been no problems reported so far, I think we can stabilize it if needed.
We usually call the maintainer before calling the herd, but here I'd say herd calling was a little overdue. Thanks for the advice, let's try to stableize this one. Arches, please test and mark stable if OK for you.
(In reply to comment #4) > Arches, please test and mark stable if OK for you. 9 of 61 tests failed on alpha... make check-TESTS make[2]: Entering directory `/var/tmp/portage/cairo-1.0.4/work/cairo-1.0.4/test' a8-mask is expected to fail: image backend fails because libpixman only handles (stride % sizeof(pixman_bits) == 0) a8-mask-image: XFAIL a8-mask-xlib: UNTESTED XFAIL: a8-mask caps-joins-image: PASS caps-joins-xlib: UNTESTED PASS: caps-joins caps-sub-paths-image: PASS caps-sub-paths-xlib: UNTESTED PASS: caps-sub-paths clip-all-image: PASS clip-all-xlib: UNTESTED PASS: clip-all clip-nesting-image: PASS clip-nesting-xlib: UNTESTED PASS: clip-nesting clip-operator-image: FAIL clip-operator-xlib: UNTESTED FAIL: clip-operator clip-twice-image: PASS clip-twice-xlib: UNTESTED PASS: clip-twice composite-integer-translate-source-image: PASS composite-integer-translate-source-xlib: UNTESTED PASS: composite-integer-translate-source composite-integer-translate-over-image: PASS composite-integer-translate-over-xlib: UNTESTED PASS: composite-integer-translate-over composite-integer-translate-over-repeat-image: PASS composite-integer-translate-over-repeat-xlib: UNTESTED PASS: composite-integer-translate-over-repeat create-from-png-image: PASS create-from-png-xlib: UNTESTED PASS: create-from-png create-from-png-stream-image: PASS create-from-png-stream-xlib: UNTESTED PASS: create-from-png-stream dash-caps-joins-image: PASS dash-caps-joins-xlib: UNTESTED PASS: dash-caps-joins dash-offset-negative-image: PASS dash-offset-negative-xlib: UNTESTED PASS: dash-offset-negative fill-and-stroke-image: PASS fill-and-stroke-xlib: UNTESTED PASS: fill-and-stroke fill-rule-image: PASS fill-rule-xlib: UNTESTED PASS: fill-rule filter-nearest-offset is expected to fail: wrong sampling location for nearest-neighbor filter in libpixman and Render filter-nearest-offset-image: XFAIL filter-nearest-offset-xlib: UNTESTED XFAIL: filter-nearest-offset get-and-set-image: PASS get-and-set-xlib: UNTESTED PASS: get-and-set gradient-alpha-image: PASS gradient-alpha-xlib: UNTESTED PASS: gradient-alpha leaky-polygon-image: PASS leaky-polygon-xlib: UNTESTED PASS: leaky-polygon line-width-image: PASS line-width-xlib: UNTESTED PASS: line-width linear-gradient-image: PASS linear-gradient-xlib: UNTESTED PASS: linear-gradient mask-image: PASS mask-xlib: UNTESTED PASS: mask mask-ctm-image: PASS mask-ctm-xlib: UNTESTED PASS: mask-ctm mask-surface-ctm-image: PASS mask-surface-ctm-xlib: UNTESTED PASS: mask-surface-ctm move-to-show-surface-image: PASS move-to-show-surface-xlib: UNTESTED PASS: move-to-show-surface nil-surface-image: PASS nil-surface-xlib: UNTESTED PASS: nil-surface operator-clear-image: FAIL operator-clear-xlib: UNTESTED FAIL: operator-clear operator-source-image: FAIL operator-source-xlib: UNTESTED FAIL: operator-source paint-image: PASS paint-xlib: UNTESTED PASS: paint paint-with-alpha-image: PASS paint-with-alpha-xlib: UNTESTED PASS: paint-with-alpha path-data-image: PASS path-data-xlib: UNTESTED PASS: path-data pixman-rotate is expected to fail: known off-by-one bug when rotating a pixman image pixman-rotate-image: XFAIL pixman-rotate-xlib: UNTESTED XFAIL: pixman-rotate rectangle-rounding-error-image: PASS rectangle-rounding-error-xlib: UNTESTED PASS: rectangle-rounding-error scale-source-surface-paint-image: PASS scale-source-surface-paint-xlib: UNTESTED PASS: scale-source-surface-paint select-font-no-show-text-image: PASS select-font-no-show-text-xlib: UNTESTED PASS: select-font-no-show-text self-copy-image: PASS self-copy-xlib: UNTESTED PASS: self-copy self-intersecting is expected to fail: Self-intersecting strokes are wrong due to incremental trapezoidization. self-intersecting-image: XFAIL self-intersecting-xlib: UNTESTED XFAIL: self-intersecting set-source-image: PASS set-source-xlib: UNTESTED PASS: set-source show-glyphs-many-image: PASS show-glyphs-many-xlib: UNTESTED PASS: show-glyphs-many show-text-current-point-image: FAIL show-text-current-point-xlib: UNTESTED FAIL: show-text-current-point source-clip-image: PASS source-clip-xlib: UNTESTED PASS: source-clip source-surface-scale-paint-image: PASS source-surface-scale-paint-xlib: UNTESTED PASS: source-surface-scale-paint surface-finish-twice-image: PASS surface-finish-twice-xlib: UNTESTED PASS: surface-finish-twice surface-pattern-image: PASS surface-pattern-xlib: UNTESTED PASS: surface-pattern text-antialias-gray-image: FAIL text-antialias-gray-xlib: UNTESTED FAIL: text-antialias-gray text-antialias-none-image: FAIL text-antialias-none-xlib: UNTESTED FAIL: text-antialias-none text-antialias-subpixel-image: FAIL text-antialias-subpixel-xlib: UNTESTED FAIL: text-antialias-subpixel text-cache-crash-image: PASS text-cache-crash-xlib: UNTESTED PASS: text-cache-crash text-pattern-image: FAIL text-pattern-xlib: UNTESTED FAIL: text-pattern text-rotate is expected to fail: minor bugs in positioning rotated glyphs text-rotate-image: XFAIL text-rotate-xlib: UNTESTED XFAIL: text-rotate transforms-image: PASS transforms-xlib: UNTESTED PASS: transforms translate-show-surface-image: PASS translate-show-surface-xlib: UNTESTED PASS: translate-show-surface trap-clip-image: PASS trap-clip-xlib: UNTESTED PASS: trap-clip unantialiased-shapes-image: PASS unantialiased-shapes-xlib: UNTESTED PASS: unantialiased-shapes unbounded-operator-image: FAIL unbounded-operator-xlib: UNTESTED FAIL: unbounded-operator PASS: user-data rel-path-image: PASS rel-path-xlib: UNTESTED PASS: rel-path PASS: pthread-show-text ft-font-create-for-ft-face-image: PASS ft-font-create-for-ft-face-xlib: UNTESTED PASS: ft-font-create-for-ft-face PASS: xlib-surface ======================================================================== 9 of 61 tests failed Please report to http://bugs.freedesktop.org/enter_bug.cgi?product=cairo ======================================================================== make[2]: *** [check-TESTS] Error 1 make[2]: Leaving directory `/var/tmp/portage/cairo-1.0.4/work/cairo-1.0.4/test' make[1]: *** [check-am] Error 2 make[1]: Leaving directory `/var/tmp/portage/cairo-1.0.4/work/cairo-1.0.4/test' make: *** [check-recursive] Error 1
ppc stable
tcort, the question is if those tests pass with 1.0.2 .
I'm just testing x11-libs/cairo-1.0.4 against x86. I'm a gnome user - thus lot's of programs link against cairo while i'm writing this. As far as i can tell (i'm now using the new cairo library for about 40min) everthing seems to work fine. Portage 2.0.54 (default-linux/x86/2006.0, gcc-3.4.5, glibc-2.3.5-r3, 2.6.15-gentoo-r5 i686) ================================================================= System uname: 2.6.15-gentoo-r5 i686 AMD Athlon(tm) XP 2400+ Gentoo Base System version 1.6.14 dev-lang/python: 2.3.5-r2, 2.4.2 sys-apps/sandbox: 1.2.12 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1 sys-devel/binutils: 2.16.1 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=athlon-xp -pipe" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/ /var/qmail/control" CONFIG_PROTECT_MASK="/etc/eselect/compiler /etc/gconf /etc/terminfo /etc/env.d" CXXFLAGS="-O2 -march=athlon-xp -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig colission-protect distlocks sandbox sfperms strict" GENTOO_MIRRORS="http://gentoo.inode.at/ " LANG="en_US.utf8" LC_ALL="en_US.utf8" LINGUAS="en de" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://192.168.0.1/gentoo-portage" USE="x86 3dnow 3dnowext X a52 aalib alsa apm audiofile avi berkdb bitmap-fonts bonobo bzip2 bzlib cairo cdr cli crypt css ctype cups curl dba dbus divx4linux dri dts dv dvd dvdr dvdread emboss encode evo exif expat fam fame fastbuild ffmpeg firefox flac foomaticdb force-cgi-redirect fortran ftp gd gdbm gif glut gmp gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml guile hal idn imagemagick imlib ipv6 isdnlog java jpeg junit lcms libg++ libwww mad memlimit mhash mikmod mmx mmxext mng motif mp3 mpeg nautilus ncurses nls nptl nsplugin nvidia ogg oggvorbis openal opengl pam pcre pdflib perl plotutils png posix pppd python quicktime readline real ruby sdl session simplexml slang soap sockets speex spell spl sqlite sse ssl subtitles svga tcltk tcpd tetex theora tiff tokenizer truetype truetype-fonts type1-fonts udev unicode usb vcd video_cards_nvidia vorbis win32codecs wma xine xml xml2 xmms xsl xv xvid zlib linguas_en linguas_de userland_GNU kernel_linux elibc_glibc" Unset: ASFLAGS, CTARGET, INSTALL_MASK, LDFLAGS
(In reply to comment #7) > tcort, the question is if those tests pass with 1.0.2 . > Yes
(In reply to comment #9) > (In reply to comment #7) > > tcort, the question is if those tests pass with 1.0.2 . The same 9 tests fail in 1.0.2 for me. ferdy tested 1.0.4 with no unexpected failures. My cairo apps (gnome-panel, mozilla-firefox, etc) are working fine with 1.0.4. stable on alpha.
amd64ized
stable on ppc64
x86 in da house!
sparc stable.
hppa done
Ready for GLSA vote, I tend to vote no...
also tending to vote no
Voting NO and closing. Feel free to reopen if you disagree.
