Your submission was sent successfully! Close

CVE-2019-20446

Published: 2 February 2020

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.

Notes

AuthorNote
mdeslaur
also affects older versions written in C
The fixes added to 2.40.21 cause a regression, and upstream will
not be fixing them.
Priority

Low

CVSS 3 base score: 6.5

Status

Package Release Status
librsvg
Launchpad, Ubuntu, Debian
bionic Needed

eoan Ignored
(reached end-of-life)
focal Not vulnerable
(2.48.7-1ubuntu0.20.04.1)
groovy Not vulnerable
(2.46.4-1ubuntu1)
hirsute Not vulnerable
(2.46.4-1ubuntu1)
impish Not vulnerable
(2.46.4-1ubuntu1)
jammy Not vulnerable
(2.46.4-1ubuntu1)
precise Does not exist

trusty Does not exist

upstream
Released (2.46.4-1)
xenial Needed

Patches:
upstream: https://gitlab.gnome.org/GNOME/librsvg/commit/572f95f739529b865e2717664d6fefcef9493135
upstream: https://gitlab.gnome.org/GNOME/librsvg/commit/27f1f35557515747c423ab780d7b1a2d7a711fa1 (2.40)