CVE-2018-18064

cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Attackers can use specially-crafted files to trigger this stack-buffer overflow in cairo. Applications compiled with cairo, which do not parse untrusted 2D image files are not vulnerable to this flaw. cairo package in Red Hat Enterprise Linux 7 and 8 is compiled with gcc's Stack Smashing Protection, which may reduce the impact of this flaw to crash only.