New release of librsvg which fixes CVE-2011-3146.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code.
(CVE-2011-3146)

This update fixes CVE-2011-3146.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1289 advisory.

    [2.26.0-5.el6_1.1]
    - Store node type separately in RsvgNode (CVE-2011-3146)       Resolves: #735266

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code (CVE-2011-3146).

The remote Solaris system is missing necessary patches to address security updates :

  - librsvg before 2.34.1 uses the node name to identify the     type of node, which allows context-dependent attackers     to cause a denial of service (NULL pointer dereference)     and possibly execute arbitrary code via a SVG file with     a node with the element name starting with 'fe,' which     is misidentified as a RsvgFilterPrimitive.
    (CVE-2011-3146)

Sauli Pahlman discovered that librsvg did not correctly handle malformed filter names. If a user or automated system were tricked into processing a specially crafted SVG image, a remote attacker could gain user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1289 advisory.

    The librsvg2 packages provide an SVG (Scalable Vector Graphics) library     based on libart.

    A flaw was found in the way librsvg2 parsed certain SVG files. An attacker     could create a specially-crafted SVG file that, when opened, would cause     applications that use librsvg2 (such as Eye of GNOME) to crash or,     potentially, execute arbitrary code. (CVE-2011-3146)

    Red Hat would like to thank the Ubuntu Security Team for reporting this     issue. The Ubuntu Security Team acknowledges Sauli Pahlman as the original     reporter.

    All librsvg2 users should upgrade to these updated packages, which contain     a backported patch to correct this issue. All running applications that use     librsvg2 must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The librsvg2 packages provide an SVG (Scalable Vector Graphics) library based on libart.

A flaw was found in the way librsvg2 parsed certain SVG files. An attacker could create a specially crafted SVG file that, when opened, would cause applications that use librsvg2 (such as Eye of GNOME) to crash or, potentially, execute arbitrary code. All librsvg2 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications that use librsvg2 must be restarted for this update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
56157	Fedora 16 : librsvg2-2.34.1-1.fc16 (2011-12312)	Nessus	Fedora Local Security Checks	9/12/2011	1/11/2021	medium
57119	SuSE 11.1 Security Update : librsvg (SAT Patch Number 5166)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	medium
56154	Fedora 15 : librsvg2-2.34.0-2.fc15 (2011-12271)	Nessus	Fedora Local Security Checks	9/12/2011	1/11/2021	medium
56232	Fedora 14 : librsvg2-2.32.0-4.fc14 (2011-12301)	Nessus	Fedora Local Security Checks	9/20/2011	1/11/2021	medium
68350	Oracle Linux 6 : librsvg2 (ELSA-2011-1289)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
75846	openSUSE Security Update : gdk-pixbuf-loader-rsvg (openSUSE-SU-2011:1090-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
80676	Oracle Solaris Third-Party Patch Update : librsvg (cve_2011_3146_denial_of)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium
56194	Ubuntu 10.04 LTS / 10.10 / 11.04 : librsvg vulnerability (USN-1206-1)	Nessus	Ubuntu Local Security Checks	9/14/2011	9/19/2019	medium
56188	RHEL 6 : librsvg2 (RHSA-2011:1289)	Nessus	Red Hat Local Security Checks	9/14/2011	11/4/2024	high
75509	openSUSE Security Update : gdk-pixbuf-loader-rsvg (openSUSE-SU-2011:1090-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
61134	Scientific Linux Security Update : librsvg2 on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

medium

medium

medium

high

medium

medium