Security update for librsvg

SUSE Security Update: Security update for librsvg
Announcement ID: SUSE-SU-2020:14323-1
Rating: moderate
References: #1083232 #1094213 #1162501 #977985 #977986 #987877
Cross-References: CVE-2015-7558 CVE-2016-4348 CVE-2016-6163 CVE-2018-1000041 CVE-2019-20446
Affected Products:
  • SUSE Linux Enterprise Debuginfo 11-SP4

An update that solves 5 vulnerabilities and has one errata is now available.

Description:


This update for librsvg fixes the following issues:

  • CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.
  • CVE-2015-7558: librsvg allowed context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document (bsc#977985).
  • CVE-2016-6163: svg pattern linking to non-pattern fallback leads to invalid memory access, allowing to cause DoS (bsc#987877).
  • CVE-2018-1000041: Fixed leaking credentials via SVG files that reference UNC paths (bsc#1083232)
  • CVE-2016-4348: Fixed a denial of service parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function (bsc#977986)
  • Fixed a stack exhaustion with circular references in elements.
  • Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG "use" elements in malicious SVGs.

This updated also removes the the Mozilla plugin package. Firefox can render SVG on its own and the plugin interface is obsolete.
This update for libcroco fixes the following issue:
  • Fixed an issue where librsvg was throwing a segmentation fault (bsc#1094213).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Debuginfo 11-SP4:
    zypper in -t patch dbgsp4-librsvg-14323=1

Package List:

  • SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):
    • libcroco-debuginfo-0.6.1-122.6.1
    • libcroco-debugsource-0.6.1-122.6.1
    • librsvg-debuginfo-2.26.0-2.6.8.3
    • librsvg-debugsource-2.26.0-2.6.8.3
  • SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64):
    • librsvg-debuginfo-32bit-2.26.0-2.6.8.3

References: