PT-2020-5329 · Gnome+7 · Librsvg+7

Published

2017-12-31

·

Updated

2022-12-08

·

CVE-2019-20446

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions librsvg versions prior to 2.46.2
Description The issue is related to a denial of service caused by a crafted SVG file with nested patterns. This file, when processed by the library, can lead to an exponential growth in the number of final rendered objects. The problem stems from an error in the resource control mechanism within the xml.rs component of the librsvg library. An attacker can exploit this vulnerability to cause a denial of service.
Recommendations For versions prior to 2.46.2, update to version 2.46.2 or later to resolve the issue. As a temporary workaround, consider restricting the processing of SVG files with nested patterns to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2020:4709
ALT-PU-2017-2857
ALT-PU-2019-2781
ALT-PU-2020-1768
BDU:2021-00123
CESA-2020_4709
CVE-2019-20446
DLA-2285-1
MGASA-2020-0159
OPENSUSE-SU-2020:0343-1
OPENSUSE-SU-2020_0343-1
OPENSUSE-SU-2024:10986-1
RHSA-2020:4709
RHSA-2020_4709
RLSA-2020:4709
SUSE-SU-2020:0604-1
SUSE-SU-2020:0629-1
SUSE-SU-2020:0629-2
SUSE-SU-2020_0604-1
SUSE-SU-2020_0629-1
SUSE-SU-2020_0629-2
USN-4436-1
USN-4436-2

Affected Products

Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Ubuntu
Librsvg