Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cairo | Redhat | * | 1.4.10 (including) |
| Red Hat Enterprise Linux 5 | RedHat | cairo-0:1.2.4-3.el5_1 | * |
| Libcairo | Ubuntu | dapper | * |
| Libcairo | Ubuntu | edgy | * |
| Libcairo | Ubuntu | feisty | * |
| Libcairo | Ubuntu | gutsy | * |
| Libcairo | Ubuntu | upstream | * |