Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors. NOTE: this issue might be resultant from an integer overflow in the fast_composite_scaled_bilinear function in pixman-inlines.h, which triggers an infinite loop.
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
| Link | Tags |
|---|---|
| http://www.palemoon.org/releasenotes-ng.shtml | broken link |
| https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0077 | third party advisory |
| http://rhn.redhat.com/errata/RHSA-2013-0687.html | third party advisory vendor advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=910149 | issue tracking exploit patch |
| http://rhn.redhat.com/errata/RHSA-2013-0746.html | third party advisory vendor advisory |
| http://cgit.freedesktop.org/pixman/commit/?id=de60e2e0e3eb6084f8f14b63f25b3cbfb012943f | mailing list patch |
| http://www.mandriva.com/security/advisories?name=MDVSA-2013:116 | vendor advisory broken link |
| https://support.f5.com/csp/article/K51392553 | third party advisory |