PT-2017-3955 · Gnome+3 · Librsvg+3
Publicado
2017-07-19
·
Atualizado
2020-07-29
·
CVE-2017-11464
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
librsvg version 2.40.17
Description
The issue is related to the implementation of the
box blur line function in the librsvg library, which is used for rendering vector graphics. It is caused by errors when performing division operations, specifically division by zero. This can be exploited by a remote attacker using a specially crafted SVG file, potentially leading to a denial of service. The box blur line function in the rsvg-filter.c file of the GNOME librsvg library is specifically affected.Recommendations
For librsvg version 2.40.17, consider avoiding the use of the
box blur line function until a patch is available. As a temporary workaround, restrict the processing of SVG files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Divide By Zero
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Ubuntu
Librsvg