CVE-2018-1000041: Input Validation
GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1000041?
CVE-2018-1000041 is a vulnerability in GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea that allows the leakage of the victim's Windows username and NTLM password hash to remote attackers through SMB.
What is the severity of CVE-2018-1000041?
CVE-2018-1000041 has a severity rating of 8.8 (high).
How does CVE-2018-1000041 work?
CVE-2018-1000041 works by exploiting an improper input validation vulnerability in rsvg-io.c of GNOME librsvg, which allows the leakage of sensitive information.
Which software versions are affected by CVE-2018-1000041?
GNOME librsvg versions up to and excluding 2.41.2 and Debian Debian Linux version 7.0 are affected by CVE-2018-1000041.
How can I fix CVE-2018-1000041?
To fix CVE-2018-1000041, it is recommended to update to a version of GNOME librsvg that includes the commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea.