Security update for librsvg
SUSE Security Update: Security update for librsvg
This updated also removes the the Mozilla plugin package. Firefox can render SVG on its own and the plugin interface is obsolete.
This update for libcroco fixes the following issue:
Announcement ID: | SUSE-SU-2020:14323-1 |
Rating: | moderate |
References: | #1083232 #1094213 #1162501 #977985 #977986 #987877 |
Cross-References: | CVE-2015-7558 CVE-2016-4348 CVE-2016-6163 CVE-2018-1000041 CVE-2019-20446 |
Affected Products: |
|
An update that solves 5 vulnerabilities and has one errata is now available.
Description:
This update for librsvg fixes the following issues:
- CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.
- CVE-2015-7558: librsvg allowed context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document (bsc#977985).
- CVE-2016-6163: svg pattern linking to non-pattern fallback leads to invalid memory access, allowing to cause DoS (bsc#987877).
- CVE-2018-1000041: Fixed leaking credentials via SVG files that reference UNC paths (bsc#1083232)
- CVE-2016-4348: Fixed a denial of service parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function (bsc#977986)
- Fixed a stack exhaustion with circular references in
- Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG "use" elements in malicious SVGs.
This updated also removes the the Mozilla plugin package. Firefox can render SVG on its own and the plugin interface is obsolete.
This update for libcroco fixes the following issue:
- Fixed an issue where librsvg was throwing a segmentation fault (bsc#1094213).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-librsvg-14323=1
Package List:
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):
- libcroco-debuginfo-0.6.1-122.6.1
- libcroco-debugsource-0.6.1-122.6.1
- librsvg-debuginfo-2.26.0-2.6.8.3
- librsvg-debugsource-2.26.0-2.6.8.3
- SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64):
- librsvg-debuginfo-32bit-2.26.0-2.6.8.3
References:
- https://www.suse.com/security/cve/CVE-2015-7558.html
- https://www.suse.com/security/cve/CVE-2016-4348.html
- https://www.suse.com/security/cve/CVE-2016-6163.html
- https://www.suse.com/security/cve/CVE-2018-1000041.html
- https://www.suse.com/security/cve/CVE-2019-20446.html
- https://bugzilla.suse.com/1083232
- https://bugzilla.suse.com/1094213
- https://bugzilla.suse.com/1162501
- https://bugzilla.suse.com/977985
- https://bugzilla.suse.com/977986
- https://bugzilla.suse.com/987877