[ GLSA 201402-03 ] Pixman: User-assisted execution of arbitrary code

[GLSA]

Gentoo Linux Security Advisory

Title: Pixman: User-assisted execution of arbitrary code (GLSA 201402-03)
Severity: normal
Exploitable: local, remote
Date: February 02, 2014
Bug(s): #493292
ID: 201402-03

Synopsis

An integer underflow vulnerability in Pixman may allow a
context-dependent attacker to cause Denial of Service.


Background

Pixman is a pixel manipulation library.

Affected Packages

Package: x11-libs/pixman
Vulnerable: < 0.32.4
Unaffected: >= 0.32.4
Architectures: All supported architectures


Description

The trapezoid handling code in Pixman contains an integer underflow
vulnerability.


Impact

A context-dependent attacker could entice a user to open a specially
crafted file using an application linked against Pixman, possibly
resulting in execution of arbitrary code with the privileges of the
process, or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Pixman users should upgrade to the latest version: