USN-4436-1 fixed a vulnerability in librsvg. The upstream fix caused a regression when parsing certain SVG files. This update backs out the fix pending further investigation.
Original advisory details:
It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11464)
It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting in a denial of service. (CVE-2019-20446)
{ "availability": "No subscription required", "binaries": [ { "binary_name": "gir1.2-rsvg-2.0", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-2", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-2-dbgsym", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-bin", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-bin-dbgsym", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-common", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-common-dbgsym", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-dev", "binary_version": "2.40.13-3ubuntu0.2" }, { "binary_name": "librsvg2-doc", "binary_version": "2.40.13-3ubuntu0.2" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "gir1.2-rsvg-2.0", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-2", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-2-dbgsym", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-bin", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-bin-dbgsym", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-common", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-common-dbgsym", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-dev", "binary_version": "2.40.20-2ubuntu0.2" }, { "binary_name": "librsvg2-doc", "binary_version": "2.40.20-2ubuntu0.2" } ] }