SUSE-SU-2020:14323-1: moderate: Security update for librsvg

sle-updates at sle-updates at
Tue Mar 17 08:15:09 MDT 2020

   SUSE Security Update: Security update for librsvg

Announcement ID:    SUSE-SU-2020:14323-1
Rating:             moderate
References:         #1083232 #1094213 #1162501 #977985 #977986 
Cross-References:   CVE-2015-7558 CVE-2016-4348 CVE-2016-6163
                    CVE-2018-1000041 CVE-2019-20446
Affected Products:
                    SUSE Linux Enterprise Debuginfo 11-SP4

   An update that solves 5 vulnerabilities and has one errata
   is now available.


   This update for librsvg fixes the following issues:

   - CVE-2019-20446: Fixed an issue where a crafted SVG file with nested
     patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now
     has limits on the number of loaded XML elements, and the number of
     referenced elements within an SVG document.
   - CVE-2015-7558: librsvg allowed context-dependent attackers to cause a
     denial of service (infinite loop, stack consumption, and application
     crash) via cyclic references in an SVG document (bsc#977985).
   - CVE-2016-6163: svg pattern linking to non-pattern fallback leads to
     invalid memory access, allowing to cause DoS (bsc#987877).
   - CVE-2018-1000041: Fixed leaking credentials via SVG files that reference
     UNC paths (bsc#1083232)
   - CVE-2016-4348: Fixed a denial of service parsing SVGs with circular
     definitions _rsvg_css_normalize_font_size() function (bsc#977986)
   - Fixed a stack exhaustion with circular references in <use> elements.
   - Fixed a denial-of-service condition from exponential explosion
     of rendered elements, through nested use of SVG "use" elements in
      malicious SVGs.

   This updated also removes the the Mozilla plugin package. Firefox can
   render SVG on its own and the plugin interface is obsolete.

   This update for libcroco fixes the following issue:

   - Fixed an issue where librsvg was throwing a segmentation fault

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-librsvg-14323=1

Package List:

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):


   - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64):



More information about the sle-updates mailing list