Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-5116 — NULL Pointer Dereference in Cairo

CWE-476 — NULL Pointer Dereference12 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
5.8%
top 9.44%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
WiresharkCairographics Cairo
Timeline
PublishedJul 29
Latest updateMay 17

Description

The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Ubuntuwireshark/wireshark< 2.6.3-1~ubuntu14.04.1+2

🔴Vulnerability Details

2
GHSA
GHSA-jcm2-jp9c-jcgg: The cairo_image_surface_get_data function in Cairo 1↗2022-05-17
▶
OSV
CVE-2014-5116: The cairo_image_surface_get_data function in Cairo 1↗2014-07-29
▶

💥Exploits & PoCs

1
Exploit-DB
Wireshark 1.10.7 - Denial of Service (PoC)↗2014-05-16
▶

📋Vendor Advisories

6
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶

💬Community

2
Bugzilla
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Bugzilla
CVE-2014-5116 cairo: NULL pointer dereference in cairo_image_surface_get_data()↗2014-07-29
▶