5.5med
CVE-2017-7475
cairo is vulnerable to denial of service due to a null pointer dereference
Also known as GHSA-5v3f-73gv-x7x5
Published 9 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 79%
Public exploits
0
none known
Summary
Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
Exploit prediction (EPSS)
1.82% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | cairo | >=1.15.4, <1.15.5 | 1.15.5 |
Affected products
- Red Hat, Inc. Cairo
Classification
- Weakness
- CWE-476 NULL Pointer Dereference
References
- bugs.freedesktop.org /show_bug.cgi?id=100763 · x_refsource_MISC, x_transferred
- seclists.org /oss-sec/2017/q2/151 · mailing-list, x_refsource_MLIST, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-7475 · x_refsource_MISC, x_transferred
- lists.apache.org /thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apach · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7475 · advisory
- github.com /rcairo/rcairo · package
- github.com /rubysec/ruby-advisory-db/blob/master/gems/cairo/CVE-2017-7475.yml · web
- lists.apache.org /thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache. · web
Sources
- CVE List: CVE-2017-7475
- GitHub Advisory: GHSA-5v3f-73gv-x7x5
- NVD: CVE-2017-7475
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.