GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
The rsvgnodepolybuildpath function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
The rsvgcssnormalizefontsize function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.
A vulnerability causing stack exhaustion leading to DoS was found in librsvg2 when parsing SVG file.
A NULL pointer dereference flaw was reported [1] by Sauli Pahlman in librsvg. If a program linked to librsvg where to open a crafted SVG file, it could cause that application to crash or potentially execute arbitrary code.
[1] https://launchpad.net/bugs/825497 https://bugzilla.gnome.org/showbug.cgi?id=658014
GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3 https://bugzilla.suse.com/showbug.cgi?id=1213502 https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
It was found that specially crafted SVG file can trigger crash in pngwriterow when converting the given SVG using librsvg2 and cairo. Crash happens inside libpng when trying to access invalid pointer.
Acknowledgements:
Name: Gustavo Grieco
I haven't seen this go by yet, so for those who haven't seen it:
https://gitlab.gnome.org/GNOME/librsvg/-/issues/996 reports:
CVE-2023-38633: Arbitrary file read when xinclude href has special characters
This was reported by Zac Sims.
<?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg width="300" height="300" xmlns:xi="http://www.w3.org/2001/XInclude";> <rect width="300" height="300" style="fill:rgb(255,255,255);" /> <text x="10" y="100"> <xi:fallback>file not found</xi:fallback> </xi:include> </text> </svg>
librsvg for many release trains:
2.56.3 2.55.3 2.54.6 2.52.10 2.50.8 2.48.11 2.46.6
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
On 7/27/23 13:36, Alan Coopersmith wrote: I haven't seen this go by yet, so for those who haven't seen it:
https://gitlab.gnome.org/GNOME/librsvg/-/issues/996 reports:
CVE-2023-38633: Arbitrary file read when xinclude href has special characters
This was reported by Zac Sims. Zac's writeup on how the bug was found is now available at: https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
It points to a root cause of mixing two different URL parsers, with one used to validate the URL and a different one used to load the content from it.
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris