GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.

This update for librsvg fixes the following issues :

  - CVE-2018-1000041: Input validation issue could lead to     credentials leak. (bsc#1083232)

Update to version 2.40.20 :

  + Except for emergencies, this will be the LAST RELEASE of     the librsvg-2.40.x series. We are moving to 2.41, which     is vastly improved over the 2.40 series. The API/ABI     there remain unchaged, so we strongly encourage you to     upgrade your sources and binaries to librsvg-2.41.x.

  + bgo#761175 - Allow masks and clips to reuse a node being     drawn.

  + Don't access the file system when deciding whether to     load a remote file with a UNC path for a paint server     (i.e. don't try to load it at all).

  + Vistual Studio: fixed and integrated introspection     builds, so introspection data is built directly from the     Visual Studio project (Chun-wei Fan).

  + Visual Studio: We now use HIGHENTROPYVA linker option on     x64 builds, to enhance the security of built binaries     (Chun-wei Fan).

  + Fix generation of Vala bindings when compiling in     read-only source directories (Emmanuele Bassi).

Update to version 2.40.19 :

  + bgo#621088: Using text objects as clipping paths is now     supported.

  + bgo#587721: Fix rendering of text elements with     transformations (Massimo).

  + bgo#777833 - Fix memory leaks when an RsvgHandle is     disposed before being closed (Philip Withnall).

  + bgo#782098 - Don't pass deprecated options to gtk-doc     (Ting-Wei Lan).

  + bgo#786372 - Fix the default for the 'type' attribute of     the <style> element.

  + bgo#785276 - Don't crash on single-byte files.

  + bgo#634514: Don't render unknown elements and their     sub-elements.

  + bgo#777155 - Ignore patterns that have close-to-zero     dimensions.

  + bgo#634324 - Fix Gaussian blurs with negative scaling.

  + Fix the <switch> element; it wasn't working at all.

  + Fix loading when rsvg_handle_write() is called one byte     at a time.

  + bgo#787895 - Fix incorrect usage of libxml2. Thanks to     Nick Wellnhofer for advice on this.

  + Backported the test suite machinery from the master     branch (Chun-wei Fan, Federico Mena).

  + We now require Pango 1.38.0 or later (released in 2015).

  + We now require libxml2 2.9.0 or later (released in     2012).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for librsvg fixes the following issues :

  - CVE-2018-1000041: Input validation issue could lead to     credentials leak. (bsc#1083232) Update to version     2.40.20 :

  + Except for emergencies, this will be the LAST RELEASE of     the librsvg-2.40.x series. We are moving to 2.41, which     is vastly improved over the 2.40 series. The API/ABI     there remain unchaged, so we strongly encourage you to     upgrade your sources and binaries to librsvg-2.41.x.

  + bgo#761175 - Allow masks and clips to reuse a node being     drawn.

  + Don't access the file system when deciding whether to     load a remote file with a UNC path for a paint server     (i.e. don't try to load it at all).

  + Vistual Studio: fixed and integrated introspection     builds, so introspection data is built directly from the     Visual Studio project (Chun-wei Fan).

  + Visual Studio: We now use HIGHENTROPYVA linker option on     x64 builds, to enhance the security of built binaries     (Chun-wei Fan).

  + Fix generation of Vala bindings when compiling in     read-only source directories (Emmanuele Bassi). Update     to version 2.40.19 :

  + bgo#621088: Using text objects as clipping paths is now     supported.

  + bgo#587721: Fix rendering of text elements with     transformations (Massimo).

  + bgo#777833 - Fix memory leaks when an RsvgHandle is     disposed before being closed (Philip Withnall).

  + bgo#782098 - Don't pass deprecated options to gtk-doc     (Ting-Wei Lan).

  + bgo#786372 - Fix the default for the 'type' attribute of     the <style> element.

  + bgo#785276 - Don't crash on single-byte files.

  + bgo#634514: Don't render unknown elements and their     sub-elements.

  + bgo#777155 - Ignore patterns that have close-to-zero     dimensions.

  + bgo#634324 - Fix Gaussian blurs with negative scaling.

  + Fix the <switch> element; it wasn't working at all.

  + Fix loading when rsvg_handle_write() is called one byte     at a time.

  + bgo#787895 - Fix incorrect usage of libxml2. Thanks to     Nick Wellnhofer for advice on this.

  + Backported the test suite machinery from the master     branch (Chun-wei Fan, Federico Mena).

  + We now require Pango 1.38.0 or later (released in 2015).

  + We now require libxml2 2.9.0 or later (released in     2012).

</style>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an input validation vulnerability in the librsvg renderer library that could result in data being leaked to remote attackers via a specially crafted file.

For Debian 7 'Wheezy', this issue has been fixed in librsvg version 2.36.1-2+deb7u3.

We recommend that you upgrade your librsvg packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
109879	openSUSE Security Update : librsvg (openSUSE-2018-466)	Nessus	SuSE Local Security Checks	high
109859	SUSE SLED12 / SLES12 Security Update : librsvg (SUSE-SU-2018:1288-1)	Nessus	SuSE Local Security Checks	high
106779	Debian DLA-1278-1 : librsvg security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-1000041

high

Tenable Plugins

high

high

high