CVE-2014-9766
published 2016-04-13CVE-2014-9766: Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application…
PriorityP343critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
5.57%
92.0th percentile
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | pixman | < pixman 0.32.6-1 (bookworm) | pixman 0.32.6-1 (bookworm) |
| pixman | pixman | <= 0.32.5 | — |
| pixman | pixman | >= 0 < 0.32.6-1 | 0.32.6-1 |
| pixman | pixman | >= 0 < 0.32.6-1 | 0.32.6-1 |
| pixman | pixman | >= 0 < 0.32.6-1 | 0.32.6-1 |
| pixman | pixman | >= 0 < 0.32.6-1 | 0.32.6-1 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wrhh-9jw8-888j: Integer overflow in the create_bits function in pixman-bits-image
ghsa_unreviewed·2022-05-17
CVE-2014-9766 [CRITICAL] GHSA-wrhh-9jw8-888j: Integer overflow in the create_bits function in pixman-bits-image
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
OSV
CVE-2014-9766: Integer overflow in the create_bits function in pixman-bits-image
osv·2016-04-13·CVSS 9.8
CVE-2014-9766 [CRITICAL] CVE-2014-9766: Integer overflow in the create_bits function in pixman-bits-image
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
Ubuntu
pixman vulnerability
vendor_ubuntu·2016-03-03
CVE-2014-9766 pixman vulnerability
Title: pixman vulnerability
Summary: pixman could be made to crash or run programs as your login if it processed
specially crafted data.
Vincent LE GARREC discovered an integer underflow in pixman. If a user were
tricked into opening a specially crafted file, a remote attacker could
cause pixman to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: After a standard system update you need to restart your session to make
all the necessary changes.
Red Hat
pixman: integer overflow in create_bits function
vendor_redhat·2014-10-14·CVSS 9.8
CVE-2014-9766 [CRITICAL] CWE-190 pixman: integer overflow in create_bits function
pixman: integer overflow in create_bits function
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: pixman (Red Hat Enterprise Linux 5) - Not affected
Package: qpixman (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: xulrunner (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: pixman (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
Package:
Debian
CVE-2014-9766: pixman - Integer overflow in the create_bits function in pixman-bits-image.c in Pixman be...
vendor_debian·2014·CVSS 9.8
CVE-2014-9766 [CRITICAL] CVE-2014-9766: pixman - Integer overflow in the create_bits function in pixman-bits-image.c in Pixman be...
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
Scope: local
bookworm: resolved (fixed in 0.32.6-1)
bullseye: resolved (fixed in 0.32.6-1)
forky: resolved (fixed in 0.32.6-1)
sid: resolved (fixed in 0.32.6-1)
trixie: resolved (fixed in 0.32.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
pixman: integer overflow in create_bits function
bugzilla·2016-06-10·CVSS 9.8
CVE-2014-9766 [CRITICAL] pixman: integer overflow in create_bits function
pixman: integer overflow in create_bits function
User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160503092137
Steps to reproduce:
CVE-2014-9766 is related to pixman: integer overflow in create_bits function, which Firefox seems to embed.
Details at:
In create_bits() both height and stride are ints, so the result is
also an int, which will overflow if height or stride are big enough
and size_t is bigger than int.
http://lists.freedesktop.org/archives/pixman/2014-April/003244.html
I find similar code in the version of pixman embedded in firefox. But i dont really have the skills to figure out, if Firefox is indeed affected.
Would appreciate if you could look, thanks!
Discussion:
Jeff, looks like the fix is from pixman 0.32.6, and
Bugzilla
CVE-2014-9766 pixman: integer overflow in create_bits function
bugzilla·2016-02-25·CVSS 9.8
CVE-2014-9766 [CRITICAL] CVE-2014-9766 pixman: integer overflow in create_bits function
CVE-2014-9766 pixman: integer overflow in create_bits function
In create_bits() both height and stride are ints, so the result is
also an int, which will overflow if height or stride are big enough
and size_t is bigger than int.
External references:
http://lists.freedesktop.org/archives/pixman/2014-April/003244.html
CVE assignment:
http://seclists.org/oss-sec/2016/q1/425
Discussion:
Updated affects list for RHEL components.
Not affected because they already have the patch:
rhel-6/pixman
rhel-7/pixman
rhel-7/qemu-guest-agent
Not affected because the guard is _pixman_multiply_overflows_int which
matches the type of each operand and thus the result of the multiplication:
rhel-5/pixman
rhel-5/qpixman
rhel-7/qemu-qvm
Removed from whiteboard because these packages don't appear to exist
http://www.debian.org/security/2016/dsa-3525http://www.openwall.com/lists/oss-security/2016/02/24/13http://www.openwall.com/lists/oss-security/2016/02/24/15http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.ubuntu.com/usn/USN-2918-1https://bugs.freedesktop.org/show_bug.cgi?id=69014https://bugzilla.redhat.com/show_bug.cgi?id=972647https://cgit.freedesktop.org/pixman/commit/?id=857e40f3d2bc2cfb714913e0cd7e6184cf69aca3https://lists.freedesktop.org/archives/pixman/2014-April/003244.htmlhttps://lists.x.org/archives/xorg-announce/2014-July/002452.htmlhttp://www.debian.org/security/2016/dsa-3525http://www.openwall.com/lists/oss-security/2016/02/24/13http://www.openwall.com/lists/oss-security/2016/02/24/15http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.ubuntu.com/usn/USN-2918-1https://bugs.freedesktop.org/show_bug.cgi?id=69014https://bugzilla.redhat.com/show_bug.cgi?id=972647https://cgit.freedesktop.org/pixman/commit/?id=857e40f3d2bc2cfb714913e0cd7e6184cf69aca3https://lists.freedesktop.org/archives/pixman/2014-April/003244.htmlhttps://lists.x.org/archives/xorg-announce/2014-July/002452.html
2016-04-13
Published