GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

librsvg was updated to fix one security issue.

This security issue was fixed :

  - CVE-2013-1881: GNOME libsvg allowed remote attackers to     read arbitrary files via an XML document containing an     external entity declaration in conjunction with an     entity reference, related to an XML External Entity     (XXE) issue (bsc#840753).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

librsvg was updated to fix a denial a XML External Entity Inclusion problem, where files on the system could be imported into the SVG.
(CVE-2013-1881)

USN-2149-1 fixed a vulnerability in librsvg. This update provides a compatibility fix for GTK+ to work with the librsvg security update.

It was discovered that librsvg would load XML external entities by default. If a user were tricked into viewing a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that librsvg would load XML external entities by default. If a user were tricked into viewing a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An XML External Entity expansion flaw was found in the way librsvg2 processed SVG files. If a user were to open a malicious SVG file, a remote attacker could possibly obtain a copy of the local resources that the user had access to. (CVE-2013-1881)

All running applications that use librsvg2 must be restarted for this update to take effect.

Updated librsvg2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

[Updated Feb 4, 2014] The original packages distributed with this advisory contained a bug that caused applications using librsvg2 to crash when loading certain SVG images. We have updated the packages to correct this bug.

The librsvg2 packages provide an SVG (Scalable Vector Graphics) library based on libart.

An XML External Entity expansion flaw was found in the way librsvg2 processed SVG files. If a user were to open a malicious SVG file, a remote attacker could possibly obtain a copy of the local resources that the user had access to. (CVE-2013-1881)

All librsvg2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications that use librsvg2 must be restarted for this update to take effect.

From Red Hat Security Advisory 2014:0127 :

Updated librsvg2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

[Updated Feb 4, 2014] The original packages distributed with this advisory contained a bug that caused applications using librsvg2 to crash when loading certain SVG images. We have updated the packages to correct this bug.

The librsvg2 packages provide an SVG (Scalable Vector Graphics) library based on libart.

An XML External Entity expansion flaw was found in the way librsvg2 processed SVG files. If a user were to open a malicious SVG file, a remote attacker could possibly obtain a copy of the local resources that the user had access to. (CVE-2013-1881)

All librsvg2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications that use librsvg2 must be restarted for this update to take effect.

Updated librsvg and gtk+3.0 packages fix security vulnerability :

librsvg before version 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference (CVE-2013-1881).

For Business Server 1 gtk+3.0 has been patched to cope with the changes in SVG loading due to the fix in librsvg.

ID	Name	Product	Family	Severity
86535	SUSE SLED11 / SLES11 Security Update : librsvg (SUSE-SU-2015:1785-1)	Nessus	SuSE Local Security Checks	medium
75217	openSUSE Security Update : librsvg (openSUSE-SU-2013:1786-1)	Nessus	SuSE Local Security Checks	medium
73078	Ubuntu 12.04 LTS / 12.10 : gtk+3.0 update (USN-2149-2)	Nessus	Ubuntu Local Security Checks	medium
73077	Ubuntu 12.04 LTS / 12.10 / 13.10 : librsvg vulnerability (USN-2149-1)	Nessus	Ubuntu Local Security Checks	medium
72275	Scientific Linux Security Update : librsvg2 on SL6.x i386/x86_64 (20140203)	Nessus	Scientific Linux Local Security Checks	medium
72274	RHEL 6 : librsvg2 (RHSA-2014:0127)	Nessus	Red Hat Local Security Checks	medium
72272	Oracle Linux 6 : librsvg2 (ELSA-2014-0127)	Nessus	Oracle Linux Local Security Checks	medium
72268	CentOS 6 : librsvg2 (CESA-2014:0127)	Nessus	CentOS Local Security Checks	medium
72023	Mandriva Linux Security Advisory : librsvg (MDVSA-2014:009)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-1881

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium