SUSE-SU-2020:0629-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2020:0629-1

Related

Published

2020-07-07T11:45:14Z

Modified

2020-07-07T11:45:14Z

Summary

Security update for librsvg

Details

This update for librsvg to version 2.42.8 fixes the following issues:

librsvg was updated to version 2.42.8 fixing the following issues:

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.
Fixed a stack exhaustion with circular references in <use> elements.
Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

References

Affected packages

Name: librsvg
Purl: pkg:rpm/suse/librsvg&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.42.8-3.3.1

{
    "binaries": [
        {
            "librsvg-2-2": "2.42.8-3.3.1",
            "gdk-pixbuf-loader-rsvg": "2.42.8-3.3.1"
        }
    ]
}

Name: librsvg
Purl: pkg:rpm/suse/librsvg&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP1

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.42.8-3.3.1

{
    "binaries": [
        {
            "librsvg-devel": "2.42.8-3.3.1",
            "typelib-1_0-Rsvg-2_0": "2.42.8-3.3.1"
        }
    ]
}