Unscored severity · published Oct 10, 2013
CVE-2013-1881
GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference,…
–
CVSS
3.2%
EPSS
No
On KEV
Description
GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Librsvg · Gnome
through 2.37.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.1.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1881
en.securitylab.ru
http://en.securitylab.ru/lab/PT-2013-01
ftp.gnome.org
http://ftp.gnome.org/pub/GNOME/sources/librsvg/2.39/librsvg-2.39.0.changes
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00020.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-11/msg00114.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0127.html
Vendor Advisory
http://secunia.com/advisories/55088
More from Librsvg
8.8
CVE-2018-1000041
GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's…
7.8
CVE-2017-11464
A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against…
7.5
CVE-2016-4348
The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular…
7.5
CVE-2015-7558
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG…
7.5
CVE-2015-7557
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an…