USN-8140-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8140-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8140-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8140-1
Upstream
Related
Published
2026-04-02T07:27:21Z
Modified
2026-04-07T11:02:28.220651089Z
Summary
cairo vulnerabilities
Details

Alberto Garcia, Francisco Oca and Suleman Ali discovered that Cairo did not properly manage memory. An attacker could possibly use this issue to cause Cairo to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2017-9814)

It was discovered that Cairo incorrectly handled certain angle values when drawing arcs. An attacker could possibly use this issue to cause Cairo to crash, resulting in a denial of service. (CVE-2019-6461)

It was discovered that Cairo incorrectly handled certain calculations when drawing arcs. An attacker could possibly use this issue to cause Cairo to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2019-6462)

Stephan Bergmann discovered that Cairo incorrectly managed memory during image composition. An attacker could use this issue to cause Cairo to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35492)

References

Affected packages

Ubuntu:Pro:16.04:LTS / cairo

Package

Name
cairo
Purl
pkg:deb/ubuntu/cairo@1.14.6-1ubuntu0.1~esm2?arch=source&distro=esm-infra/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.6-1ubuntu0.1~esm2

Affected versions

1.*
1.14.2-2ubuntu2
1.14.4-1
1.14.6-1
1.14.6-1ubuntu0.1~esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "cairo-perf-utils",
            "binary_version": "1.14.6-1ubuntu0.1~esm2"
        },
        {
            "binary_name": "libcairo-gobject2",
            "binary_version": "1.14.6-1ubuntu0.1~esm2"
        },
        {
            "binary_name": "libcairo-script-interpreter2",
            "binary_version": "1.14.6-1ubuntu0.1~esm2"
        },
        {
            "binary_name": "libcairo2",
            "binary_version": "1.14.6-1ubuntu0.1~esm2"
        },
        {
            "binary_name": "libcairo2-dev",
            "binary_version": "1.14.6-1ubuntu0.1~esm2"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6461"
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8140-1.json"

Ubuntu:Pro:18.04:LTS / cairo

Package

Name
cairo
Purl
pkg:deb/ubuntu/cairo@1.15.10-2ubuntu0.1+esm1?arch=source&distro=esm-infra/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15.10-2ubuntu0.1+esm1

Affected versions

1.*
1.14.10-1ubuntu1
1.15.8-2
1.15.8-3
1.15.10-2
1.15.10-2ubuntu0.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "cairo-perf-utils",
            "binary_version": "1.15.10-2ubuntu0.1+esm1"
        },
        {
            "binary_name": "libcairo-gobject2",
            "binary_version": "1.15.10-2ubuntu0.1+esm1"
        },
        {
            "binary_name": "libcairo-script-interpreter2",
            "binary_version": "1.15.10-2ubuntu0.1+esm1"
        },
        {
            "binary_name": "libcairo2",
            "binary_version": "1.15.10-2ubuntu0.1+esm1"
        },
        {
            "binary_name": "libcairo2-dev",
            "binary_version": "1.15.10-2ubuntu0.1+esm1"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8140-1.json"
cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2017-9814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6461"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6462"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2020-35492"
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}

Ubuntu:Pro:20.04:LTS / cairo

Package

Name
cairo
Purl
pkg:deb/ubuntu/cairo@1.16.0-4ubuntu1+esm1?arch=source&distro=esm-infra/focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.16.0-4ubuntu1+esm1

Affected versions

1.*
1.16.0-4
1.16.0-4ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "cairo-perf-utils",
            "binary_version": "1.16.0-4ubuntu1+esm1"
        },
        {
            "binary_name": "libcairo-gobject2",
            "binary_version": "1.16.0-4ubuntu1+esm1"
        },
        {
            "binary_name": "libcairo-script-interpreter2",
            "binary_version": "1.16.0-4ubuntu1+esm1"
        },
        {
            "binary_name": "libcairo2",
            "binary_version": "1.16.0-4ubuntu1+esm1"
        },
        {
            "binary_name": "libcairo2-dev",
            "binary_version": "1.16.0-4ubuntu1+esm1"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2017-9814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6461"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6462"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2020-35492"
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8140-1.json"

Ubuntu:22.04:LTS / cairo

Package

Name
cairo
Purl
pkg:deb/ubuntu/cairo@1.16.0-5ubuntu2.1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.16.0-5ubuntu2.1

Affected versions

1.*
1.16.0-5ubuntu1
1.16.0-5ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "cairo-perf-utils",
            "binary_version": "1.16.0-5ubuntu2.1"
        },
        {
            "binary_name": "libcairo-gobject2",
            "binary_version": "1.16.0-5ubuntu2.1"
        },
        {
            "binary_name": "libcairo-script-interpreter2",
            "binary_version": "1.16.0-5ubuntu2.1"
        },
        {
            "binary_name": "libcairo2",
            "binary_version": "1.16.0-5ubuntu2.1"
        },
        {
            "binary_name": "libcairo2-dev",
            "binary_version": "1.16.0-5ubuntu2.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map 
{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2017-9814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6461"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ],
            "id": "CVE-2019-6462"
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8140-1.json"