An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - pixman: general_composite_rect() integer overflow (CVE-2015-5297)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the pixman packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow issue has been reported in the     general_composite_rect() function in pixman prior to     version 0.32.8. An attacker could exploit this issue to     cause an application using pixman to crash or,     potentially, execute arbitrary code.(CVE-2015-5297)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3843-1 advisory.

    It was discovered that pixman incorrectly handled the general_composite_rect function. A remote attacker     could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2015-5297 Numerical overflow in pointer arithmetic.

For Debian 8 'Jessie', this problem has been fixed in version 0.32.6-3+deb8u1.

We recommend that you upgrade your pixman packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199568	RHEL 5 : pixman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
135551	EulerOS 2.0 SP3 : pixman (EulerOS-SA-2020-1422)	Nessus	Huawei Local Security Checks	critical
131640	EulerOS 2.0 SP2 : pixman (EulerOS-SA-2019-2487)	Nessus	Huawei Local Security Checks	critical
119653	Ubuntu 14.04 LTS : pixman vulnerability (USN-3843-1)	Nessus	Ubuntu Local Security Checks	critical
119104	Debian DLA-1587-1 : pixman security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-5297

critical

Tenable Plugins

critical

critical

critical

critical

critical