Firefox and Thunderbird possibly affected by CVE-2016-3190

[Thomas Mayer]

Firefox comes along with a heavily patched version of libcairo 1.9.5. That holds true even for Firefox 47.0 which comes shipped with ubuntu 16.04. It should also hold true with all versions of Firefox back to ~2010 at least.

According to

https://www.suse.com/security/cve/CVE-2016-3190.html
https://www.cvedetails.com/cve/CVE-2016-3190/

all versions of cairo before 1.14.2 are affected by CVE-2016-3190. That would include many Firefox versions.

To my knowledge, ubuntu builds Firefox and Thunderbird packages against against Mozilla's patched libcairo 1.9.5 which is in their mercurical repo in gfx/cairo/cairo. The libcairo2 ubuntu/debian package is not used for compilation (I tried it out via https://bugs.launchpad.net/ubuntu/+source/cups/+bug/802942).

Please check if CVE-2016-3190 is patched in mozilla-upstream and if CVE-2016-3190 could somehow be used by attackers.

It could also be that the whole issue is just SuSE related, but I think this is not very likely.

[Thomas Mayer (thomas303)]

As far as I can see, cairo-image-compositor.c does not exist in the mercurial repo of mozilla.

Plus, is there no function fill_xrgb32_lerp_opaque_spans (I fgrepped the whole FF repo).

I guess cairo-image-compositor.c that was introduced in 1.11.4 (>1.9.5) for the first time.

I think this issue can be closed then. FF seems not to be affected by CVE-2016-3190.

[Tyler Hicks (tyhicks)]

Marking invalid per comment #1.