FreeBSD : py-svglib -- Multiple vulnerabilities (bdac753c-d1d5-11f1-985e-901b0edee044)

critical Nessus Plugin ID 372882

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bdac753c-d1d5-11f1-985e-901b0edee044 advisory.

Dinu Gherman reports:
The SVG <path> elliptical-arc parser in svglib.utils.split_arc_values() builds a regex with multiple empty-matchable float groups and two mandatory flag groups, then runs it under re.finditer().
An arc argument that is a long run of digits (containing no 0/1 where a flag is expected) triggers catastrophic backtracking whose cost grows exponentially (~2x per ~4 extra digits). Reachable from any untrusted SVG via svg2rlg / svg2pdf.
svg2rlg() expands <use> references without any limit on the total number of expansions. Only direct cycles are rejected (CircularRefError).
A group containing N <use> elements that point to another such group multiplies the work by N per nesting level, so an SVG of about 1.4 KB makes svglib clone and render over 100,000 nodes, taking tens of seconds of CPU time and hundreds of MiB of memory. Each additional level adds about 245 bytes to the document and multiplies time by ~10.

This is the SVG <use> variant of the XML billion laughs attack (the same class as librsvg CVE-2019-20446).
svglib converts SVG into ReportLab drawings / PDF / PNG (svg2rlg).
When it renders an or element, SvgRenderer.xlink_href_target() resolves the element's xlink:href / href to a local file path and embeds that file into the output. The resolution joins the attacker-controlled reference onto the SVG's own directory with os.path.join() and performs no containment check. Because os.path.join(base, iri) discards base the moment iri is absolute, and ..
segments collapse above base, a crafted SVG can name any file the rendering process can read. If that file decodes as a raster image (any extension) its bytes are copied verbatim into the output; if it is an XML-parseable .svg its rendered content, text included, is inlined. The result is arbitrary local file read against a service that converts untrusted SVGs from a file path. This is a different class and a different code path from the 2020 XXE (CVE-2020-10799, fixed in 0.9.4).

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 372882

File Name: freebsd_pkg_bdac753cd1d511f1985e901b0edee044.nasl

Version: 1.1

Type: Local

Family: FreeBSD Local Security Checks

Published: 10/28/2026

Updated: 10/28/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-10799

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:py311-svglib, p-cpe:/a:freebsd:freebsd:py312-svglib, p-cpe:/a:freebsd:freebsd:py313-svglib, p-cpe:/a:freebsd:freebsd:py313t-svglib, p-cpe:/a:freebsd:freebsd:py314-svglib, p-cpe:/a:freebsd:freebsd:py314t-svglib, p-cpe:/a:freebsd:freebsd:py315-svglib

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 2/2/2020

Reference Information

CVE: CVE-2019-20446, CVE-2020-10799

Detections

Analytics