An update of the cairo package has been released.

According to the versions of the cairo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in cairo 1.16.0. There is an     assertion problem in the function
    _cairo_arc_in_direction in the file     cairo-arc.c.(CVE-2019-6461)

  - An issue was discovered in cairo 1.16.0. There is an     infinite loop in the function _arc_error_normalized in     the file cairo-arc.c, related to
    _arc_max_angle_for_tolerance_normalized.(CVE-2019-6462)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cairo packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in cairo 1.16.0. There is an     infinite loop in the function _arc_error_normalized in     the file cairo-arc.c, related to
    _arc_max_angle_for_tolerance_normalized.(CVE-2019-6462)

  - An issue was discovered in cairo 1.16.0. There is an     assertion problem in the function
    _cairo_arc_in_direction in the file     cairo-arc.c.(CVE-2019-6461)

  - Cairo version 1.15.4 is vulnerable to a NULL pointer     dereference related to the FT_Load_Glyph and     FT_Render_Glyph resulting in an application     crash.(CVE-2017-7475)

  - A flaw was found in cairo's image-compositor.c in all     versions prior to 1.17.4. This flaw allows an attacker     who can provide a crafted input file to cairo's     image-compositor (for example, by convincing a user to     open a file in an application using cairo, or if an     application uses cairo on untrusted input) to cause a     stack buffer overflow -> out-of-bounds WRITE. The     highest impact from this vulnerability is to     confidentiality, integrity, as well as system     availability.(CVE-2020-35492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

远程主机受到 GLSA-202408-09 中所述漏洞影响（Cairo：多个漏洞）

    已在 Cairo 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。

Tenable 已直接从 Gentoo Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 cairo 1.16.0 中发现了一个问题。函数中存在断言问题
    cairo-arc.c 文件中的 _cairo_arc_in_direction。 (CVE-2019-6461)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - cairo 1.16.0で問題が見つかりました。関数にアサーションの問題があります
    ファイル cairo-arc.c の _cairo_arc_in_direction。 （CVE-2019-6461）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートの SUSE Linux SLES12 ホストには、SUSE-SU-2025:03450-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    - CVE-2019-6461NaN アングルでアークを描画する際のアサーションを回避します。bsc#1122338
    - CVE-2025-50422Poppler のクラッシュを引き起こす「active_edges_to_traps()」の NULL ポインターアクセスを修正します。
    (bsc#1247589)

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端主機受到 GLSA-202408-09 中所述的弱點影響 (Cairo：多個弱點)

    在 Cairo 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。

Tenable 已直接從 Gentoo Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 cairo 1.16.0 中發現一個問題。函式中有宣告問題
    cairo-arc.c 中的 _cairo_arc_in_direction。 (CVE-2019-6461)

請注意，Nessus 依賴供應商報告的套件存在。

The remote host is affected by the vulnerability described in GLSA-202408-09 (Cairo: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Cairo. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03450-1 advisory.

    - CVE-2019-6461: Avoid assert when drawing arcs with NaN angles. (bsc#1122338)
    - CVE-2025-50422: Fix NULL pointer access in `active_edges_to_traps()` leading to crash in Poppler.
    (bsc#1247589)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in cairo 1.16.0. There is an assertion problem in the function
    _cairo_arc_in_direction in the file cairo-arc.c. (CVE-2019-6461)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the cairo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in cairo 1.16.0. There is an     assertion problem in the function
    _cairo_arc_in_direction in the file     cairo-arc.c.(CVE-2019-6461)

  - An issue was discovered in cairo 1.16.0. There is an     infinite loop in the function _arc_error_normalized in     the file cairo-arc.c, related to
    _arc_max_angle_for_tolerance_normalized.(CVE-2019-6462)

  - Cairo version 1.15.4 is vulnerable to a NULL pointer     dereference related to the FT_Load_Glyph and     FT_Render_Glyph resulting in an application     crash.(CVE-2017-7475)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
203095	Photon OS 2.0: Cairo PHSA-2019-2.0-0145	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
144220	EulerOS 2.0 SP5 : cairo (EulerOS-SA-2020-2540)	Nessus	Huawei Local Security Checks	2020/12/15	2024/2/2	medium
140824	EulerOS 2.0 SP3 : cairo (EulerOS-SA-2020-2057)	Nessus	Huawei Local Security Checks	2020/9/28	2024/2/19	medium
151296	EulerOS Virtualization for ARM 64 3.0.2.0 : cairo (EulerOS-SA-2021-2095)	Nessus	Huawei Local Security Checks	2021/7/2	2023/12/11	high
205142	GLSA-202408-09：Cairo：多个漏洞	Nessus	Gentoo Local Security Checks	2024/8/7	2024/8/7	medium
222887	Linux Distros 未修补的漏洞: CVE-2019-6461	Nessus	Misc.	2025/3/4	2025/10/14	medium
222887	Linux Distros のパッチ未適用の脆弱性: CVE-2019-6461	Nessus	Misc.	2025/3/4	2025/10/14	medium
266440	SUSE SLES12 セキュリティ更新cairoSUSE-SU-2025:03450-1	Nessus	SuSE Local Security Checks	2025/10/3	2025/10/3	medium
205142	GLSA-202408-09：Cairo：多個弱點	Nessus	Gentoo Local Security Checks	2024/8/7	2024/8/7	medium
222887	Linux Distros 未修補弱點：CVE-2019-6461	Nessus	Misc.	2025/3/4	2025/10/14	medium
205142	GLSA-202408-09 : Cairo: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/8/7	2024/8/7	medium
266440	SUSE SLES12 Security Update : cairo (SUSE-SU-2025:03450-1)	Nessus	SuSE Local Security Checks	2025/10/3	2025/10/3	medium
222887	Linux Distros Unpatched Vulnerability : CVE-2019-6461	Nessus	Misc.	2025/3/4	2025/10/14	medium
147438	EulerOS Virtualization 3.0.6.6 : cairo (EulerOS-SA-2021-1461)	Nessus	Huawei Local Security Checks	2021/3/10	2024/1/11	medium
203096	Photon OS 3.0: Cairo PHSA-2019-3.0-0008	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	medium
125156	Photon OS 1.0: Cairo PHSA-2019-1.0-0220	Nessus	PhotonOS Local Security Checks	2019/5/15	2024/5/22	medium

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium