First Last Prev Next    This bug is not in your last search results.
Bug 714980 - VUL-0: librsvg security issue
VUL-0: librsvg security issue
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
maint:released:11.3:43232 maint:relea...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2011-08-30 15:19 UTC by Ludwig Nussel
Modified: 2017-01-11 02:01 UTC (History)
4 users (show)

See Also:
Found By: Other
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2011-08-30 15:19:33 UTC 
Your friendly security team received the following report via vendor-sec.
Please respond ASAP.
This issue is not public yet, please keep any information about it inside SUSE.
Note that build.opensuse.org *cannot* be used to prepare embargoed updates.

Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code (CVE-2011-3146).

https://launchpad.net/bugs/825497
Comment 4 Marcus Meissner 2011-09-02 12:26:57 UTC 
CVE-2011-3146
Comment 5 Marcus Meissner 2011-09-02 12:27:12 UTC 
https://bugzilla.gnome.org/show_bug.cgi?id=658014
Comment 6 Swamp Workflow Management 2011-09-02 12:36:13 UTC 
The SWAMPID for this issue is 43002.
This issue was rated as moderate.
Please submit fixed packages until 2011-09-16.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 7 Vincent Untz 2011-09-09 13:36:07 UTC 
I have packages ready to test for openSUSE 11.3 and 11.4 (they both need testing). I need to fix virtualbox to test them (it's not installable on factory), though :/
Comment 9 Matthias Weckbecker 2011-09-12 10:17:49 UTC 
bug is public meanwhile:

https://bugzilla.gnome.org/show_bug.cgi?id=658014#c7
Comment 10 Matthias Weckbecker 2011-09-12 10:26:51 UTC 
SLE-10-SP3/SP4 does not seem to be affected, whereas SLE-11-SP1 is.
Comment 13 Vincent Untz 2011-09-16 11:19:19 UTC 
I've been able to test on 11.3 and 11.4, and the issue is fixed. So I submitted the update for openSUSE: 82364 82365.
Comment 14 Swamp Workflow Management 2011-10-05 09:41:22 UTC 
Update released for: gdk-pixbuf-loader-rsvg, gdk-pixbuf-loader-rsvg-debuginfo, gtk2-engine-svg, gtk2-engine-svg-debuginfo, librsvg, librsvg-2-2, librsvg-2-2-debuginfo, librsvg-debuginfo, librsvg-debugsource, librsvg-devel, rsvg-view, rsvg-view-debuginfo
Products:
openSUSE 11.3 (debug, i586, x86_64)
openSUSE 11.4 (debug, i586, x86_64)
Comment 16 Swamp Workflow Management 2011-10-05 12:08:38 UTC 
Update released for: librsvg, librsvg-32bit, librsvg-debuginfo, librsvg-debuginfo-32bit, librsvg-debuginfo-x86, librsvg-debugsource, librsvg-devel, librsvg-plugin, librsvg-x86, rsvg-view
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 17 Bernhard Wiedemann 2011-10-06 06:00:09 UTC 
This is an autogenerated message for OBS integration:
This bug (714980) was mentioned in
https://build.opensuse.org/request/show/86863 Evergreen:11.2 / librsvg
Comment 18 Bernhard Wiedemann 2011-10-09 19:00:09 UTC 
This is an autogenerated message for OBS integration:
This bug (714980) was mentioned in
https://build.opensuse.org/request/show/87186 Evergreen:11.1 / librsvg
Comment 19 Bernhard Wiedemann 2011-10-11 16:00:32 UTC 
This is an autogenerated message for OBS integration:
This bug (714980) was mentioned in
https://build.opensuse.org/request/show/87414 Evergreen:11.1 / librsvg
First Last Prev Next    This bug is not in your last search results.