In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has librsvg2 packages installed that are affected by a vulnerability:

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4709 advisory.

  - librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4709 advisory.

  - librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

USN-4436-1 fixed a vulnerability in librsvg. The upstream fix caused a regression when parsing certain SVG files. This update backs out the fix pending further investigation.

It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11464) It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting in a denial of service. (CVE-2019-20446).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11464) It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting in a denial of service. (CVE-2019-20446).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in librsvg, an SVG rendering library. This update corrects some denial of service issues via exponential element processing, stack exhaustion or application crash when processing specially crafted files, as well as some memory safety issues.

For Debian 9 stretch, these problems have been fixed in version 2.40.21-0+deb9u1.

We recommend that you upgrade your librsvg packages.

For the detailed security status of librsvg please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/librsvg

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues:&#9; 

  - CVE-2019-20446: Fixed an issue where a crafted SVG file     with nested patterns can cause denial of service     (bsc#1162501). NOTE: Librsvg now has limits on the     number of loaded XML elements, and the number of     referenced elements within an SVG document. 

  - Fixed a stack exhaustion with circular references in     <use> elements.

  - Fixed a denial-of-service condition from exponential     explosion of rendered elements, through nested use of     SVG 'use' elements in malicious SVGs. 

This update was imported from the SUSE:SLE-15:Update update project.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.
</use>

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.40.21 fixes the following issues :

librsvg was updated to version 2.40.21 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.
</use>

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Librsvg2 developers reports :

Backport the following fixes from 2.46.x :

Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document. This is to mitigate malicious SVGs which try to consume all memory, and those which try to consume an exponential amount of CPU time.

Fix stack exhaustion with circular references in <use> elements.

Fix a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG <use> elements in malicious SVGs. This is similar to the XML 'billion laughs attack' but for SVG instancing.

ID	Name	Product	Family	Severity
184909	Rocky Linux 8 : librsvg2 (RLSA-2020:4709)	Nessus	Rocky Linux Local Security Checks	medium
157664	AlmaLinux 8 : librsvg2 (ALSA-2020:4709)	Nessus	Alma Linux Local Security Checks	medium
147351	NewStart CGSL MAIN 6.02 : librsvg2 Vulnerability (NS-SA-2021-0065)	Nessus	NewStart CGSL Local Security Checks	medium
145915	CentOS 8 : librsvg2 (CESA-2020:4709)	Nessus	CentOS Local Security Checks	medium
142798	Oracle Linux 8 : librsvg2 (ELSA-2020-4709)	Nessus	Oracle Linux Local Security Checks	medium
142439	RHEL 8 : librsvg2 (RHSA-2020:4709)	Nessus	Red Hat Local Security Checks	medium
139180	Ubuntu 16.04 LTS / 18.04 LTS : librsvg regression (USN-4436-2)	Nessus	Ubuntu Local Security Checks	high
139024	Ubuntu 16.04 LTS / 18.04 LTS : librsvg vulnerabilities (USN-4436-1)	Nessus	Ubuntu Local Security Checks	high
138858	Debian DLA-2285-1 : librsvg security update	Nessus	Debian Local Security Checks	high
138257	SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-2)	Nessus	SuSE Local Security Checks	medium
134990	Fedora 30 : chromium (2020-39e0b8bd14)	Nessus	Fedora Local Security Checks	high
134718	Fedora 31 : chromium (2020-f6271d7afa)	Nessus	Fedora Local Security Checks	high
134619	openSUSE Security Update : librsvg (openSUSE-2020-343)	Nessus	SuSE Local Security Checks	medium
134400	SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-1)	Nessus	SuSE Local Security Checks	medium
134351	SUSE SLES12 Security Update : librsvg (SUSE-SU-2020:0604-1)	Nessus	SuSE Local Security Checks	medium
134257	FreeBSD : librsvg2 -- multiple vulnabilities (b66583ae-5aee-4cd5-bb31-b2d397f8b6b3)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-20446

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

high

high

medium

high

high

medium

medium

medium

medium