In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension     in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain     sensitive information by sniffing the network during a session in which there was an incorrect decision to     accept a compromised and revoked certificate. (CVE-2014-8642)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject     stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.
    (CVE-2018-12398)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has librsvg2 packages installed that are affected by a vulnerability:

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4709 advisory.

  - librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4709 advisory.

    [2.42.7-4]
    - Resolves: rhbz#1804519 Add patch for CVE-2019-20446

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4709 advisory.

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

    Security Fix(es):

    * librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4436-1 advisory.

    It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could     possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only     affected Ubuntu 16.04 LTS. (CVE-2017-11464)

    It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A     remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting     in a denial of service. (CVE-2019-20446)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in librsvg, an SVG rendering library. This update corrects some denial of service issues via exponential element processing, stack exhaustion or application crash when processing specially crafted files, as well as some memory safety issues.

For Debian 9 stretch, these problems have been fixed in version 2.40.21-0+deb9u1.

We recommend that you upgrade your librsvg packages.

For the detailed security status of librsvg please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/librsvg

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues:&#9; 

  - CVE-2019-20446: Fixed an issue where a crafted SVG file     with nested patterns can cause denial of service     (bsc#1162501). NOTE: Librsvg now has limits on the     number of loaded XML elements, and the number of     referenced elements within an SVG document. 

  - Fixed a stack exhaustion with circular references in     <use> elements.

  - Fixed a denial-of-service condition from exponential     explosion of rendered elements, through nested use of     SVG 'use' elements in malicious SVGs. 

This update was imported from the SUSE:SLE-15:Update update project.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.
</use>

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.40.21 fixes the following issues :

librsvg was updated to version 2.40.21 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.
</use>

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Librsvg2 developers reports :

Backport the following fixes from 2.46.x :

Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document. This is to mitigate malicious SVGs which try to consume all memory, and those which try to consume an exponential amount of CPU time.

Fix stack exhaustion with circular references in <use> elements.

Fix a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG <use> elements in malicious SVGs. This is similar to the XML 'billion laughs attack' but for SVG instancing.

ID	Name	Product	Family	Severity
200050	RHEL 7 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199961	RHEL 8 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
184909	Rocky Linux 8 : librsvg2 (RLSA-2020:4709)	Nessus	Rocky Linux Local Security Checks	medium
157664	AlmaLinux 8 : librsvg2 (ALSA-2020:4709)	Nessus	Alma Linux Local Security Checks	medium
147351	NewStart CGSL MAIN 6.02 : librsvg2 Vulnerability (NS-SA-2021-0065)	Nessus	NewStart CGSL Local Security Checks	medium
145915	CentOS 8 : librsvg2 (CESA-2020:4709)	Nessus	CentOS Local Security Checks	medium
142798	Oracle Linux 8 : librsvg2 (ELSA-2020-4709)	Nessus	Oracle Linux Local Security Checks	medium
142439	RHEL 8 : librsvg2 (RHSA-2020:4709)	Nessus	Red Hat Local Security Checks	medium
139024	Ubuntu 16.04 LTS / 18.04 LTS : librsvg vulnerabilities (USN-4436-1)	Nessus	Ubuntu Local Security Checks	high
138858	Debian DLA-2285-1 : librsvg security update	Nessus	Debian Local Security Checks	high
138257	SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-2)	Nessus	SuSE Local Security Checks	medium
134990	Fedora 30 : chromium (2020-39e0b8bd14)	Nessus	Fedora Local Security Checks	high
134718	Fedora 31 : chromium (2020-f6271d7afa)	Nessus	Fedora Local Security Checks	high
134619	openSUSE Security Update : librsvg (openSUSE-2020-343)	Nessus	SuSE Local Security Checks	medium
134400	SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-1)	Nessus	SuSE Local Security Checks	medium
134351	SUSE SLES12 Security Update : librsvg (SUSE-SU-2020:0604-1)	Nessus	SuSE Local Security Checks	medium
134257	FreeBSD : librsvg2 -- multiple vulnabilities (b66583ae-5aee-4cd5-bb31-b2d397f8b6b3)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-20446

medium

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

high

high

medium

high

high

medium

medium

medium

medium