Security update for librsvg

SUSE Security Update: Security update for librsvg
Announcement ID: SUSE-SU-2018:1288-1
Rating: moderate
References: #1083232
Affected Products:
  • SUSE Linux Enterprise Software Development Kit 12-SP3
  • SUSE Linux Enterprise Server 12-SP3
  • SUSE Linux Enterprise Desktop 12-SP3

  • An update that fixes one vulnerability is now available.

    Description:

    This update for librsvg fixes the following issues:

    - CVE-2018-1000041: Input validation issue could lead to credentials leak.
    (bsc#1083232)

    Update to version 2.40.20:

    + Except for emergencies, this will be the LAST RELEASE of the
    librsvg-2.40.x series. We are moving to 2.41, which is vastly
    improved over the 2.40 series. The API/ABI there remain unchaged, so
    we strongly encourage you to upgrade your sources and binaries to
    librsvg-2.41.x.
    + bgo#761175 - Allow masks and clips to reuse a node being drawn.
    + Don't access the file system when deciding whether to load a remote
    file with a UNC path for a paint server (i.e. don't try to load it at
    all).
    + Vistual Studio: fixed and integrated introspection builds, so
    introspection data is built directly from the Visual Studio project
    (Chun-wei Fan).
    + Visual Studio: We now use HIGHENTROPYVA linker option on x64 builds,
    to enhance the security of built binaries (Chun-wei Fan).
    + Fix generation of Vala bindings when compiling in read-only source
    directories (Emmanuele Bassi).

    Update to version 2.40.19:

    + bgo#621088: Using text objects as clipping paths is now supported.
    + bgo#587721: Fix rendering of text elements with transformations
    (Massimo).
    + bgo#777833 - Fix memory leaks when an RsvgHandle is disposed before
    being closed (Philip Withnall).
    + bgo#782098 - Don't pass deprecated options to gtk-doc (Ting-Wei Lan).
    + bgo#786372 - Fix the default for the "type" attribute of the

    Patch Instructions:

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Software Development Kit 12-SP3:
      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-912=1
    • SUSE Linux Enterprise Server 12-SP3:
      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-912=1
    • SUSE Linux Enterprise Desktop 12-SP3:
      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-912=1

    Package List:

    • SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):
      • librsvg-debugsource-2.40.20-5.6.1
      • librsvg-devel-2.40.20-5.6.1
      • typelib-1_0-Rsvg-2_0-2.40.20-5.6.1
    • SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):
      • gdk-pixbuf-loader-rsvg-2.40.20-5.6.1
      • gdk-pixbuf-loader-rsvg-debuginfo-2.40.20-5.6.1
      • librsvg-2-2-2.40.20-5.6.1
      • librsvg-2-2-debuginfo-2.40.20-5.6.1
      • librsvg-debugsource-2.40.20-5.6.1
      • rsvg-view-2.40.20-5.6.1
      • rsvg-view-debuginfo-2.40.20-5.6.1
    • SUSE Linux Enterprise Server 12-SP3 (s390x x86_64):
      • librsvg-2-2-32bit-2.40.20-5.6.1
      • librsvg-2-2-debuginfo-32bit-2.40.20-5.6.1
    • SUSE Linux Enterprise Desktop 12-SP3 (x86_64):
      • gdk-pixbuf-loader-rsvg-2.40.20-5.6.1
      • gdk-pixbuf-loader-rsvg-debuginfo-2.40.20-5.6.1
      • librsvg-2-2-2.40.20-5.6.1
      • librsvg-2-2-32bit-2.40.20-5.6.1
      • librsvg-2-2-debuginfo-2.40.20-5.6.1
      • librsvg-2-2-debuginfo-32bit-2.40.20-5.6.1
      • librsvg-debugsource-2.40.20-5.6.1
      • rsvg-view-2.40.20-5.6.1
      • rsvg-view-debuginfo-2.40.20-5.6.1

    References: