SUSE-SU-2020:14323-1: moderate: Security update for librsvg

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for librsvg
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:14323-1
Rating:             moderate
References:         #1083232 #1094213 #1162501 #977985 #977986 
                    #987877 
Cross-References:   CVE-2015-7558 CVE-2016-4348 CVE-2016-6163
                    CVE-2018-1000041 CVE-2019-20446
Affected Products:
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that solves 5 vulnerabilities and has one errata
   is now available.

Description:


   This update for librsvg fixes the following issues:

   - CVE-2019-20446: Fixed an issue where a crafted SVG file with nested
     patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now
     has limits on the number of loaded XML elements, and the number of
     referenced elements within an SVG document.
   - CVE-2015-7558: librsvg allowed context-dependent attackers to cause a
     denial of service (infinite loop, stack consumption, and application
     crash) via cyclic references in an SVG document (bsc#977985).
   - CVE-2016-6163: svg pattern linking to non-pattern fallback leads to
     invalid memory access, allowing to cause DoS (bsc#987877).
   - CVE-2018-1000041: Fixed leaking credentials via SVG files that reference
     UNC paths (bsc#1083232)
   - CVE-2016-4348: Fixed a denial of service parsing SVGs with circular
     definitions _rsvg_css_normalize_font_size() function (bsc#977986)
   - Fixed a stack exhaustion with circular references in <use> elements.
   - Fixed a denial-of-service condition from exponential explosion
     of rendered elements, through nested use of SVG "use" elements in
      malicious SVGs.

   This updated also removes the the Mozilla plugin package. Firefox can
   render SVG on its own and the plugin interface is obsolete.

   This update for libcroco fixes the following issue:

   - Fixed an issue where librsvg was throwing a segmentation fault
     (bsc#1094213).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-librsvg-14323=1



Package List:

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):

      libcroco-debuginfo-0.6.1-122.6.1
      libcroco-debugsource-0.6.1-122.6.1
      librsvg-debuginfo-2.26.0-2.6.8.3
      librsvg-debugsource-2.26.0-2.6.8.3

   - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64):

      librsvg-debuginfo-32bit-2.26.0-2.6.8.3


References:

   https://www.suse.com/security/cve/CVE-2015-7558.html
   https://www.suse.com/security/cve/CVE-2016-4348.html
   https://www.suse.com/security/cve/CVE-2016-6163.html
   https://www.suse.com/security/cve/CVE-2018-1000041.html
   https://www.suse.com/security/cve/CVE-2019-20446.html
   https://bugzilla.suse.com/1083232
   https://bugzilla.suse.com/1094213
   https://bugzilla.suse.com/1162501
   https://bugzilla.suse.com/977985
   https://bugzilla.suse.com/977986
   https://bugzilla.suse.com/987877