The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a     denial of service (stack consumption and application crash) via circular definitions in an SVG document.
    (CVE-2016-4348)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The _rsvg_css_normalize_font_size function in librsvg     2.40.2 allows context-dependent attackers to cause a     denial of service (stack consumption and application     crash) via circular definitions in an SVG     document.(CVE-2016-4348)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This librsvg update to version 2.40.15 fixes the following issues :

Security issues fixed :

  - CVE-2016-4348: DoS parsing SVGs with circular     definitions _rsvg_css_normalize_font_size() function     (boo#977986)

Bugs fixed :

  - Actually scale the image if required, regression fix     from upstream git (bgo#760262).

  - Fixed bgo#759084: Don't crash when filters don't     actually exist.

  - Updated our autogen.sh to use modern autotools.

  - Fixed bgo#761728: Memory leak in the     PrimitiveComponentTransfer filter.

  - Added basic support for the 'baseline-shift' attribute     in text objects (bgo#340047).

  - Fixed some duplicate logic when rendering paths     (bgo#749415).

  - Rewrote the markers engine (bgo#685906, bgo#760180).

  - Refactoring of the test harness to use Glib's gtest     infrastructure, instead of using home-grown machinery.
    Tests can simply be put as SVG files in the     tests/subdirectories; it is not necessary to list them     explicitly in some text file.

  - Gzipped SVGs now work if read from streams.

  - References to objects/filters/URIs/etc. are now handled     lazily. Also, there is a general-purpose cycle detector     so malformed SVGs don't cause infinite loops.

  - Removed parsing of Adobe blend modes; they were not     implemented, anyway.

  - Add project files for building on Visual Studio     (bgo#753555).

  - Added an '--export-id' option to rsvg-convert(1). This     lets you select a single object to export, for example,     to pick out a group from a multi-part drawing. Note that     this is mostly useful for PNG output right now; for SVG     output we don't preserve many attributes which could be     useful in the extracted version. Doing this properly     requires an internal 'output to SVG' backend instead of     just telling Cairo to render to SVG.

Gustavo Grieco discovered several flaws in the way librsvg, a SAX-based renderer library for SVG files, parses SVG files with circular definitions. A remote attacker can take advantage of these flaws to cause an application using the librsvg library to crash.

(Note CVE-2016-4347 is a duplicate of CVE-2015-7558)

Two DoS in librsvg 2.40.2 parsing SVGs with circular definitions were found (they will produce stack exhaustion) by Gustavo Grieco.

The version in wheezy (2.36.1-2+deb7u1) is also vulnerable.

For Debian 7 'Wheezy', these problems have been fixed in version 2.36.1-2+deb7u2.

We recommend that you upgrade your librsvg packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
219685	Linux Distros Unpatched Vulnerability : CVE-2016-4348	Nessus	Misc.	high
102224	EulerOS 2.0 SP2 : librsvg2 (EulerOS-SA-2017-1137)	Nessus	Huawei Local Security Checks	high
102223	EulerOS 2.0 SP1 : librsvg2 (EulerOS-SA-2017-1136)	Nessus	Huawei Local Security Checks	high
91278	openSUSE Security Update : librsvg (openSUSE-2016-608)	Nessus	SuSE Local Security Checks	high
91266	Debian DSA-3584-1 : librsvg - security update	Nessus	Debian Local Security Checks	high
91197	Debian DLA-477-1 : librsvg security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-4348

high

Tenable Plugins

high

high

high

high

high

high