Bugzilla – Bug 977985
VUL-1: CVE-2015-7558: librsvg2: DoS parsing SVGs with circular definitions in certain rsvg_cairo_*() functions
Last modified: 2020-05-12 17:51:30 UTC
rh#1331724 CVE-2016-4347 References: https://bugzilla.redhat.com/show_bug.cgi?id=1331724 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4347 http://seclists.org/oss-sec/2016/q2/164 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4347.html https://git.gnome.org/browse/librsvg/commit/?id=8ee18b22ece0f869cb4e2e021c01138cbb8a0226
The fixes have been in place since librsvg-2.40.12. These days we can simply update to 2.40.15, which has a bunch of additional fixes.
We have very old versions of librsvg in our old distros (SLE-10-SP2 has 2.12.7, which is from before 2005!). I'll see if it is possible to patch all the library source files to update them to the latest version; there is plenty of new code to deal with malicious SVG files. There are some things that got removed in librsvg since that version (the GTK+ theme engine which practically no one was using, anyway), and it requires a new version of gdk-pixbuf. I'll see what can be made to work.
I have a repository for the backports to librsvg-2.26.0 here: https://gitlab.suse.de/federico-mena/librsvg/tree/suse-2.26.0-to-2.40.16 This is the codebase for 2.40.16 backported to 2.26.0, and adjusted to work with GTK2 (the new version uses GTK3). This takes care of the CVEs. It builds out of git, but I'm having trouble with the RPM. I'll keep working on this.
Submitted to SUSE:SLE-11-SP1:Update with id 126310. Submitted to SUSE:SLE-11:Update with id 126411.
CVE was rejected: ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7558. Reason: This candidate is a reservation duplicate of CVE-2015-7558. Notes: All CVE users should reference CVE-2015-7558 instead of this candidate.
(In reply to Johannes Segitz from comment #6) > CVE was rejected: > ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7558. > Reason: This candidate is a reservation duplicate of CVE-2015-7558. Notes: > All CVE users should reference CVE-2015-7558 instead of this candidate. Ah, okay. I just re-submitted to SUSE:SLE-11-SP1:Update with id 126449. This one references CVE-2015-7558 and CVE-2016-6163.
Created attachment 827536 [details] circular-1.svg Reproducer #1
Created attachment 827537 [details] circular-2.svg Reproducer #2