CVE-2007-5503 Integer overflow in n/a

Medium 6.8 Published 30 Nov 2007 Updated 7 Aug 2024

Remote attackers can execute arbitrary code via crafted PNG images exploiting integer overflows in the Cairo graphics library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2007-5503?

CVE-2007-5503 is a medium-severity vulnerability in n/a, published on 30 Nov 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.

Weakness: CWE-189

Which versions are affected by CVE-2007-5503?

It affects 1 product.

Linux distribution packages (8)

`cairo` Red Hat:enterprise_linux:5::client	All versions	`0:1.2.4-3.el5_1`
`cairo-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:1.2.4-3.el5_1`
`cairo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.4-3.el5_1`
`cairo-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.4-3.el5_1`
`cairo-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.4-3.el5_1`
`cairo` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.4-3.el5_1`
`cairo-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.4-3.el5_1`
`cairo-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.4-3.el5_1`

Products include Redhat Cairo.

How do I fix CVE-2007-5503?

Upgrade to a fixed version.

Is CVE-2007-5503 being exploited?

There is no known exploitation of CVE-2007-5503 in the wild and no public exploit code.

Sources

Also known as DSA-1542-1, DTSA-96-1, GHSA-8cvg-h746-3fgp, RHSA-2007:1078.