PT-2012-1676 · Gnome+1 · Librsvg+1

Published 2011-09-13 · Updated 2012-09-13 · CVE-2011-3146

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions librsvg versions prior to 2.34.1

Description The issue allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.

Recommendations For versions prior to 2.34.1, update to version 2.34.1 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2011-3146

OPENSUSE-SU-2024:10229-1

RHSA-2011:1289

RHSA-2011_1289

Affected Products

Red Hat

Librsvg

References · 17

• 🔥 http://git.gnome.org/browse/librsvg/commit/?id=34c95743ca692ea0e44778e41a7c0a129363de84 · Exploit
• http://secunia.com/advisories/45877 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1289.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065730.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065739.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066127.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1289.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3146 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3146 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-3146 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2011:1289 · Note
• https://bugs.launchpad.net/ubuntu/+source/librsvg/+bug/825497 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=734936 · Note
• https://bugzilla.gnome.org/show_bug.cgi?id=658014 · Note