librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.

The remote Solaris system is missing necessary patches to address security updates :

  - librsvg before 2.34.1 uses the node name to identify the     type of node, which allows context-dependent attackers     to cause a denial of service (NULL pointer dereference)     and possibly execute arbitrary code via a SVG file with     a node with the element name starting with 'fe,' which     is misidentified as a RsvgFilterPrimitive.
    (CVE-2011-3146)

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code (CVE-2011-3146).

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1289 advisory.

    [2.26.0-5.el6_1.1]
    - Store node type separately in RsvgNode (CVE-2011-3146)       Resolves: #735266

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The librsvg2 packages provide an SVG (Scalable Vector Graphics) library based on libart.

A flaw was found in the way librsvg2 parsed certain SVG files. An attacker could create a specially crafted SVG file that, when opened, would cause applications that use librsvg2 (such as Eye of GNOME) to crash or, potentially, execute arbitrary code. All librsvg2 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications that use librsvg2 must be restarted for this update to take effect.

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code.
(CVE-2011-3146)

This update fixes CVE-2011-3146.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sauli Pahlman discovered that librsvg did not correctly handle malformed filter names. If a user or automated system were tricked into processing a specially crafted SVG image, a remote attacker could gain user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1289 advisory.

    The librsvg2 packages provide an SVG (Scalable Vector Graphics) library     based on libart.

    A flaw was found in the way librsvg2 parsed certain SVG files. An attacker     could create a specially-crafted SVG file that, when opened, would cause     applications that use librsvg2 (such as Eye of GNOME) to crash or,     potentially, execute arbitrary code. (CVE-2011-3146)

    Red Hat would like to thank the Ubuntu Security Team for reporting this     issue. The Ubuntu Security Team acknowledges Sauli Pahlman as the original     reporter.

    All librsvg2 users should upgrade to these updated packages, which contain     a backported patch to correct this issue. All running applications that use     librsvg2 must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New release of librsvg which fixes CVE-2011-3146.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80676	Oracle Solaris Third-Party Patch Update : librsvg (cve_2011_3146_denial_of)	Nessus	Solaris Local Security Checks	medium
75846	openSUSE Security Update : gdk-pixbuf-loader-rsvg (openSUSE-SU-2011:1090-1)	Nessus	SuSE Local Security Checks	medium
75509	openSUSE Security Update : gdk-pixbuf-loader-rsvg (openSUSE-SU-2011:1090-1)	Nessus	SuSE Local Security Checks	medium
68350	Oracle Linux 6 : librsvg2 (ELSA-2011-1289)	Nessus	Oracle Linux Local Security Checks	critical
61134	Scientific Linux Security Update : librsvg2 on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57119	SuSE 11.1 Security Update : librsvg (SAT Patch Number 5166)	Nessus	SuSE Local Security Checks	medium
56232	Fedora 14 : librsvg2-2.32.0-4.fc14 (2011-12301)	Nessus	Fedora Local Security Checks	medium
56194	Ubuntu 10.04 LTS / 10.10 / 11.04 : librsvg vulnerability (USN-1206-1)	Nessus	Ubuntu Local Security Checks	medium
56188	RHEL 6 : librsvg2 (RHSA-2011:1289)	Nessus	Red Hat Local Security Checks	high
56157	Fedora 16 : librsvg2-2.34.1-1.fc16 (2011-12312)	Nessus	Fedora Local Security Checks	medium
56154	Fedora 15 : librsvg2-2.34.0-2.fc15 (2011-12271)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-3146

high

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium

high

medium

medium