PT-2013-1190 · Gnome+4 · Libsvg2+5
Alexey Osipov
+1
·
Publicado
2013-10-10
·
Atualizado
2016-12-08
·
CVE-2013-1881
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
librsvg2 versions 2.26.0
GNOME libsvg versions prior to 2.39.0
Description
The issue allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.
Recommendations
For librsvg2 version 2.26.0, update to a version that includes the fix for this issue.
For GNOME libsvg versions prior to 2.39.0, update to version 2.39.0 or later.
As a temporary workaround, consider restricting the use of XML external entities in librsvg2 until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Gnome Librsvg
Red Hat
Suse
Libsvg2