The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chromium-browser: Buffer overflow in Skia (CVE-2014-7904)

  - librsvg: SIGFPE is raised in box_blur_line function of rsvg-filter.c (CVE-2017-11464)

  - The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent     attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a     coordinate pair in an SVG document. (CVE-2015-7557)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - librsvg: SIGFPE is raised in box_blur_line function of rsvg-filter.c (CVE-2017-11464)

  - The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent     attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a     coordinate pair in an SVG document. (CVE-2015-7557)

  - librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop,     stack consumption, and application crash) via cyclic references in an SVG document. (CVE-2015-7558)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - librsvg: SIGFPE is raised in box_blur_line function of rsvg-filter.c (CVE-2017-11464)

  - The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent     attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a     coordinate pair in an SVG document. (CVE-2015-7557)

  - librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop,     stack consumption, and application crash) via cyclic references in an SVG document. (CVE-2015-7558)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The _rsvg_css_normalize_font_size function in librsvg     2.40.2 allows context-dependent attackers to cause a     denial of service (stack consumption and application     crash) via circular definitions in an SVG     document.(CVE-2016-4348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This librsvg update to version 2.40.15 fixes the following issues :

Security issues fixed :

  - CVE-2016-4348: DoS parsing SVGs with circular     definitions _rsvg_css_normalize_font_size() function     (boo#977986)

Bugs fixed :

  - Actually scale the image if required, regression fix     from upstream git (bgo#760262).

  - Fixed bgo#759084: Don't crash when filters don't     actually exist.

  - Updated our autogen.sh to use modern autotools.

  - Fixed bgo#761728: Memory leak in the     PrimitiveComponentTransfer filter.

  - Added basic support for the 'baseline-shift' attribute     in text objects (bgo#340047).

  - Fixed some duplicate logic when rendering paths     (bgo#749415).

  - Rewrote the markers engine (bgo#685906, bgo#760180).

  - Refactoring of the test harness to use Glib's gtest     infrastructure, instead of using home-grown machinery.
    Tests can simply be put as SVG files in the     tests/subdirectories; it is not necessary to list them     explicitly in some text file.

  - Gzipped SVGs now work if read from streams.

  - References to objects/filters/URIs/etc. are now handled     lazily. Also, there is a general-purpose cycle detector     so malformed SVGs don't cause infinite loops.

  - Removed parsing of Adobe blend modes; they were not     implemented, anyway.

  - Add project files for building on Visual Studio     (bgo#753555).

  - Added an '--export-id' option to rsvg-convert(1). This     lets you select a single object to export, for example,     to pick out a group from a multi-part drawing. Note that     this is mostly useful for PNG output right now; for SVG     output we don't preserve many attributes which could be     useful in the extracted version. Doing this properly     requires an internal 'output to SVG' backend instead of     just telling Cairo to render to SVG.

Gustavo Grieco discovered several flaws in the way librsvg, a SAX-based renderer library for SVG files, parses SVG files with circular definitions. A remote attacker can take advantage of these flaws to cause an application using the librsvg library to crash.

(Note CVE-2016-4347 is a duplicate of CVE-2015-7558)

Two DoS in librsvg 2.40.2 parsing SVGs with circular definitions were found (they will produce stack exhaustion) by Gustavo Grieco.

The version in wheezy (2.36.1-2+deb7u1) is also vulnerable.

For Debian 7 'Wheezy', these problems have been fixed in version 2.36.1-2+deb7u2.

We recommend that you upgrade your librsvg packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
200022	RHEL 7 : librsvg2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199991	RHEL 5 : librsvg2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199942	RHEL 6 : librsvg2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
102224	EulerOS 2.0 SP2 : librsvg2 (EulerOS-SA-2017-1137)	Nessus	Huawei Local Security Checks	high
102223	EulerOS 2.0 SP1 : librsvg2 (EulerOS-SA-2017-1136)	Nessus	Huawei Local Security Checks	high
91278	openSUSE Security Update : librsvg (openSUSE-2016-608)	Nessus	SuSE Local Security Checks	high
91266	Debian DSA-3584-1 : librsvg - security update	Nessus	Debian Local Security Checks	high
91197	Debian DLA-477-1 : librsvg security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-4348

high

Tenable Plugins

high

high

high

high

high

high

high

high