CVE-2019-6461
published 2019-01-16CVE-2019-6461: An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
2.12%
79.5th percentile
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cairographics | cairo | — | — |
| cairographics | cairo | >= 0 < 1.18.0-1 | 1.18.0-1 |
| cairographics | cairo | >= 0 < 1.18.0-1 | 1.18.0-1 |
| cairographics | cairo | >= 0 < 1.16.0-5ubuntu2.1 | 1.16.0-5ubuntu2.1 |
| cairographics | cairo | >= 0 < 1.14.6-1ubuntu0.1~esm2 | 1.14.6-1ubuntu0.1~esm2 |
| cairographics | cairo | >= 0 < 1.15.10-2ubuntu0.1+esm1 | 1.15.10-2ubuntu0.1+esm1 |
| cairographics | cairo | >= 0 < 1.16.0-4ubuntu1+esm1 | 1.16.0-4ubuntu1+esm1 |
| debian | cairo | < cairo 1.18.0-1 (forky) | cairo 1.18.0-1 (forky) |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_cairo_1.17.4-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5LOW
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Cairo vulnerabilities
vendor_ubuntu·2026-04-02·CVSS 7.5
CVE-2019-6462 [HIGH] Cairo vulnerabilities
Title: Cairo vulnerabilities
Summary: Several security issues were fixed in Cairo.
Alberto Garcia, Francisco Oca and Suleman Ali discovered that Cairo did
not properly manage memory. An attacker could possibly use this issue to
cause Cairo to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2017-9814)
It was discovered that Cairo incorrectly handled certain angle values when
drawing arcs. An attacker could possibly use this issue to cause Cairo to
crash, resulting in a denial of service. (CVE-2019-6461)
It was discovered that Cairo incorrectly handled certain calculations when
drawing arcs. An attacker could possibly use this issue to cause Cairo to
consume resources, resulting in a denial of service. This i
Red Hat
cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c
vendor_redhat·2019-01-11·CVSS 6.5
CVE-2019-6461 [MEDIUM] CWE-617 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c
cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
A vulnerability was found in Cairo due to an assertion flaw in the _cairo_arc_in_direction function within cairo-arc.c, where an attacker can exploit the issue by convincing a victim to open a specially crafted file, which could trigger the assertion failure and cause the application to crash, resulting in a denial of service.
Statement: This vulnerability is rated as a moderate because it allows a denial of service due to an assertion failure in the _cairo_arc_in_direction function within cairo-arc.c, processing malformed input may trigger this issue, causing application crashes and thi
Microsoft
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
vendor_msrc·2019-01-08·CVSS 6.5
CVE-2019-6461 [MEDIUM] CWE-617 An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer A
Debian
CVE-2019-6461: cairo - An issue was discovered in cairo 1.16.0. There is an assertion problem in the fu...
vendor_debian·2019·CVSS 6.5
CVE-2019-6461 [MEDIUM] CVE-2019-6461: cairo - An issue was discovered in cairo 1.16.0. There is an assertion problem in the fu...
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.18.0-1)
sid: resolved (fixed in 1.18.0-1)
trixie: resolved (fixed in 1.18.0-1)
OSV
cairo vulnerabilities
osv·2026-04-02·CVSS 7.5
CVE-2017-9814 [HIGH] cairo vulnerabilities
cairo vulnerabilities
Alberto Garcia, Francisco Oca and Suleman Ali discovered that Cairo did
not properly manage memory. An attacker could possibly use this issue to
cause Cairo to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2017-9814)
It was discovered that Cairo incorrectly handled certain angle values when
drawing arcs. An attacker could possibly use this issue to cause Cairo to
crash, resulting in a denial of service. (CVE-2019-6461)
It was discovered that Cairo incorrectly handled certain calculations when
drawing arcs. An attacker could possibly use this issue to cause Cairo to
consume resources, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubun
GHSA
GHSA-pf7q-pwfc-88m3: An issue was discovered in cairo 1
ghsa_unreviewed·2022-05-13
CVE-2019-6461 [MEDIUM] CWE-617 GHSA-pf7q-pwfc-88m3: An issue was discovered in cairo 1
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
OSV
CVE-2019-6461: An issue was discovered in cairo 1
osv·2019-01-16·CVSS 6.5
CVE-2019-6461 [MEDIUM] CVE-2019-6461: An issue was discovered in cairo 1
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-6461 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [fedora-all]
bugzilla·2019-01-25·CVSS 6.5
CVE-2019-6461 [MEDIUM] CVE-2019-6461 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [fedora-all]
CVE-2019-6461 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple su
Bugzilla
CVE-2019-6461 mingw-cairo: cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [epel-7]
bugzilla·2019-01-25·CVSS 6.5
CVE-2019-6461 [MEDIUM] CVE-2019-6461 mingw-cairo: cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [epel-7]
CVE-2019-6461 mingw-cairo: cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following
Bugzilla
CVE-2019-6461 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c
bugzilla·2019-01-25·CVSS 6.5
CVE-2019-6461 [MEDIUM] CVE-2019-6461 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c
CVE-2019-6461 cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
References:
https://gitlab.freedesktop.org/cairo/cairo/issues/352
Discussion:
Created cairo tracking bugs for this issue:
Affects: fedora-all [bug 1669630]
Created mingw-cairo tracking bugs for this issue:
Affects: epel-7 [bug 1669632]
Affects: fedora-all [bug 1669631]
---
Confirmed present in cairo < 1.16.0, here specifically checking v1.15.12 used in the OCP mediawiki container
https://gitlab.freedesktop.org/cairo/cairo/blob/1.15.12/src/cairo-arc.c#L189
---
Statement:
This issue affects the versions of cairo as shipped with Red Hat Enterprise Linux 7.
This iss
Bugzilla
CVE-2019-6461 mingw-cairo: cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [fedora-all]
bugzilla·2019-01-25·CVSS 6.5
CVE-2019-6461 [MEDIUM] CVE-2019-6461 mingw-cairo: cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [fedora-all]
CVE-2019-6461 mingw-cairo: cairo: assertion problem in _cairo_arc_in_direction in cairo-arc.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
https://github.com/TeamSeri0us/pocs/tree/master/gerbvhttps://gitlab.freedesktop.org/cairo/cairo/issues/352https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://github.com/TeamSeri0us/pocs/tree/master/gerbvhttps://gitlab.freedesktop.org/cairo/cairo/issues/352https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
2019-01-16
Published