CVE-2015-7557: Input Validation
Published May 20, 2016
·Updated
The rsvgnodepolybuildpath function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
Affected Software
1 affected component
Gnome librsvg<=2.40.6
Event History
May 20, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7557?
CVE-2015-7557 has a moderate severity level as it allows attackers to cause a denial of service.
2
How do I fix CVE-2015-7557?
To fix CVE-2015-7557, update librsvg to version 2.40.7 or later.
3
What systems are affected by CVE-2015-7557?
CVE-2015-7557 affects librsvg versions prior to 2.40.7.
4
What type of vulnerability is CVE-2015-7557?
CVE-2015-7557 is classified as a denial of service vulnerability caused by an out-of-bounds heap read.
5
Can CVE-2015-7557 be exploited by remote attackers?
Yes, CVE-2015-7557 can be exploited by context-dependent attackers via specific SVG documents.