librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.

The remote Solaris system is missing necessary patches to address security updates :

  - librsvg before 2.34.1 uses the node name to identify the     type of node, which allows context-dependent attackers     to cause a denial of service (NULL pointer dereference)     and possibly execute arbitrary code via a SVG file with     a node with the element name starting with 'fe,' which     is misidentified as a RsvgFilterPrimitive.
    (CVE-2011-3146)

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code (CVE-2011-3146).

From Red Hat Security Advisory 2011:1289 :

Updated librsvg2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The librsvg2 packages provide an SVG (Scalable Vector Graphics) library based on libart.

A flaw was found in the way librsvg2 parsed certain SVG files. An attacker could create a specially crafted SVG file that, when opened, would cause applications that use librsvg2 (such as Eye of GNOME) to crash or, potentially, execute arbitrary code. (CVE-2011-3146)

Red Hat would like to thank the Ubuntu Security Team for reporting this issue. The Ubuntu Security Team acknowledges Sauli Pahlman as the original reporter.

All librsvg2 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications that use librsvg2 must be restarted for this update to take effect.

The librsvg2 packages provide an SVG (Scalable Vector Graphics) library based on libart.

A flaw was found in the way librsvg2 parsed certain SVG files. An attacker could create a specially crafted SVG file that, when opened, would cause applications that use librsvg2 (such as Eye of GNOME) to crash or, potentially, execute arbitrary code. All librsvg2 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications that use librsvg2 must be restarted for this update to take effect.

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code.
(CVE-2011-3146)

This update fixes CVE-2011-3146.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sauli Pahlman discovered that librsvg did not correctly handle malformed filter names. If a user or automated system were tricked into processing a specially crafted SVG image, a remote attacker could gain user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1289 advisory.

  - librsvg: object type mismatch leading to invalid pointer dereference (CVE-2011-3146)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New release of librsvg which fixes CVE-2011-3146.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80676	Oracle Solaris Third-Party Patch Update : librsvg (cve_2011_3146_denial_of)	Nessus	Solaris Local Security Checks	medium
75846	openSUSE Security Update : gdk-pixbuf-loader-rsvg (openSUSE-SU-2011:1090-1)	Nessus	SuSE Local Security Checks	medium
75509	openSUSE Security Update : gdk-pixbuf-loader-rsvg (openSUSE-SU-2011:1090-1)	Nessus	SuSE Local Security Checks	medium
68350	Oracle Linux 6 : librsvg2 (ELSA-2011-1289)	Nessus	Oracle Linux Local Security Checks	medium
61134	Scientific Linux Security Update : librsvg2 on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57119	SuSE 11.1 Security Update : librsvg (SAT Patch Number 5166)	Nessus	SuSE Local Security Checks	medium
56232	Fedora 14 : librsvg2-2.32.0-4.fc14 (2011-12301)	Nessus	Fedora Local Security Checks	medium
56194	Ubuntu 10.04 LTS / 10.10 / 11.04 : librsvg vulnerability (USN-1206-1)	Nessus	Ubuntu Local Security Checks	medium
56188	RHEL 6 : librsvg2 (RHSA-2011:1289)	Nessus	Red Hat Local Security Checks	critical
56157	Fedora 16 : librsvg2-2.34.1-1.fc16 (2011-12312)	Nessus	Fedora Local Security Checks	medium
56154	Fedora 15 : librsvg2-2.34.0-2.fc15 (2011-12271)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-3146

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium