SUSE-SU-2025:03449-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2025/suse-su-202503449-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:03449-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2025:03449-1
Upstream
Related
Published
2025-10-02T07:15:18Z
Modified
2025-10-02T16:32:11.054399Z
Summary
Security update for cairo
Details

This update for cairo fixes the following issues:

  • CVE-2025-50422: Fixed Poppler crash on malformed input (bsc#1247589)

  • Update to version 1.18.4:

    • The dependency on LZO has been made optional through a build time configuration toggle.
    • You can build Cairo against a Freetype installation that does not have the FT_Color type.
    • Cairo tests now build on Solaris 11.4 with GCC 14.
    • The DirectWrite backend now builds on MINGW 11.
    • The DirectWrite backend now supports font variations and proper glyph coverage.
  • Use tarball in lieu of source service due to freedesktop gitlab migration, will switch back at next release at the latest.

  • Add pkgconfig(lzo2) BuildRequires: New optional dependency, build lzo2 support feature.

  • Convert to source service: allows for easier upgrades by the GNOME team.

  • Update to version 1.18.2:

    • The malloc-stats code has been removed from the tests directory
    • Cairo now requires a version of pixman equal to, or newer than, 0.40.
    • There have been multiple build fixes for newer versions of GCC for MSVC; for Solaris; and on macOS 10.7.
    • PNG errors caused by loading malformed data are correctly propagated to callers, so they can handle the case.
    • Both stroke and fill colors are now set when showing glyphs on a PDF surface.
    • All the font options are copied when creating a fallback font object.
    • When drawing text on macOS, Cairo now tries harder to select the appropriate font name.
    • Cairo now prefers the COLRv1 table inside a font, if one is available.
    • Cairo requires a C11 toolchain when building.
References

Affected packages

openSUSE:Leap 15.6

cairo

Package

Name
cairo
Purl
pkg:rpm/opensuse/cairo&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-150600.3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "libcairo2": "1.18.4-150600.3.3.1",
            "cairo-tools": "1.18.4-150600.3.3.1",
            "libcairo-script-interpreter2": "1.18.4-150600.3.3.1",
            "libcairo2-32bit": "1.18.4-150600.3.3.1",
            "libcairo-gobject2": "1.18.4-150600.3.3.1",
            "libcairo-gobject2-32bit": "1.18.4-150600.3.3.1",
            "cairo-devel": "1.18.4-150600.3.3.1",
            "cairo-devel-32bit": "1.18.4-150600.3.3.1",
            "libcairo-script-interpreter2-32bit": "1.18.4-150600.3.3.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP6

cairo

Package

Name
cairo
Purl
pkg:rpm/suse/cairo&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-150600.3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "cairo-devel": "1.18.4-150600.3.3.1",
            "libcairo-gobject2": "1.18.4-150600.3.3.1",
            "libcairo-script-interpreter2": "1.18.4-150600.3.3.1",
            "libcairo2": "1.18.4-150600.3.3.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP7

cairo

Package

Name
cairo
Purl
pkg:rpm/suse/cairo&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-150600.3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "cairo-devel": "1.18.4-150600.3.3.1",
            "libcairo-gobject2": "1.18.4-150600.3.3.1",
            "libcairo-script-interpreter2": "1.18.4-150600.3.3.1",
            "libcairo2": "1.18.4-150600.3.3.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Desktop Applications 15 SP6

cairo

Package

Name
cairo
Purl
pkg:rpm/suse/cairo&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-150600.3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "libcairo2-32bit": "1.18.4-150600.3.3.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Desktop Applications 15 SP7

cairo

Package

Name
cairo
Purl
pkg:rpm/suse/cairo&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.4-150600.3.3.1

Ecosystem specific 

{
    "binaries": [
        {
            "libcairo2-32bit": "1.18.4-150600.3.3.1"
        }
    ]
}