Memory Management Vulnerability in Cairo Package: CVE-2018-19876
Summary
ALPINE-CVE-2018-19876: cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error. Affects cairo versions < 1.16.0-r1. Fixed in 1.16.0-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Cairo is a 2D graphics library that supports multiple output devices. It provides high-quality vector graphics and is widely used in various applications for rendering graphics. The library is known for its ability to produce consistent output on different devices and supports multiple backends, including image buffers, PDF, and SVG. However, it has been identified to have a critical vulnerability that affects its memory management, specifically in the function cairo_ft_apply_variations().
Vulnerability Detail
The vulnerability, identified as CVE-2018-19876, arises from improper memory management in the cairo_ft_apply_variations() function located in cairo-ft-font.c. This flaw allows the library to free memory using a deallocation function that is incompatible with WebKit's fastMalloc. As a result, this can lead to application crashes, manifesting as a 'free(): invalid pointer' error. The implications of this vulnerability are significant, as it can cause instability in applications relying on Cairo for rendering, potentially leading to denial of service.
How To Fix
Minimum fixed version
1.16.0-r1
This is the first release that contains the fix.
sudo apk add --upgrade cairoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately possible, consider isolating the application using Cairo from critical systems to minimize the impact of potential crashes. Additionally, monitor the application closely for any signs of instability.
Conclusion
CVE-2018-19876 represents a significant vulnerability in the Cairo graphics library, affecting its memory management and leading to potential application crashes. It is crucial for users to update to the patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for cairo →
FAQ
CVE-2018-19876 is a vulnerability in the Cairo graphics library that can lead to application crashes due to improper memory management.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can cause applications that use the Cairo library to crash, leading to potential denial of service.
The CVSS score for CVE-2018-19876 is 6.5, indicating a medium severity level.
You can update the Cairo package by running the command: apk add cairo=1.16.0-r1 in your Alpine package manager.
References
Related vulnerabilities
Recent vulnerabilities recorded for cairo.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
