cairo is vulnerable to denial of service due to a null pointer dereference

中危 5.5CVE-2017-7475 · GHSA-5v3f-73gv-x7x5 · Published 19/05/2017 · updated 17/06/2026

要点

CVE-2017-7475 是影响 cairo, cairo (cairographics) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.8%，高于 78.9% 的漏洞。
修复：升级到 1.15.5 或更高版本。

Package	Affected versions	Patched versions
cairo RubyGems	`≥ 1.15.4, < 1.15.5`	`1.15.5`
cairo cairographics	`= 1.15.4`	No fix yet

Description

Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.

NVD description

Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.

References

nvd.nist.gov/vuln/detail/CVE-2017-7475 · ADVISORY
bugs.freedesktop.org/show_bug.cgi · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
rcairo/rcairo · PACKAGE
rubysec/ruby-advisory-db · WEB
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E · WEB
seclists.org/oss-sec/2017/q2/151 · WEB
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free