LI
Product
Librsvg
10
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 3Low 0
Watch
Add Librsvg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1000041 | 8.8 | Feb 9 | GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's… Affected: before 2.41.2 |
| CVE-2017-11464 | 7.8 | Jul 19 | A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against… Affected: 2.40.17 |
| CVE-2016-4348 | 7.5 | May 20 | The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular… Affected: through 2.40.1 |
| CVE-2015-7558 | 7.5 | May 20 | librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG… Affected: through 2.40.11 |
| CVE-2015-7557 | 7.5 | May 20 | The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an… Affected: through 2.40.6 |
| CVE-2019-20446 | 6.5 | Feb 2 | In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing Affected: before 2.40.21; 2.42.0 before 2.42.8; 2.44.0 before 2.44.16 |
| CVE-2023-38633 | 5.5 | Jul 22 | A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the… Affected: 2.42.3 before 2.46.6; 2.48.0 before 2.48.11; 2.50.0 before 2.50.8; 2.52.0 before 2.52.10; 2.54.0 before 2.54.6; 2.55.0 before 2.55.3; +1 more |
| CVE-2016-6163 | 5.5 | Feb 3 | The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file Affected: 2.40.2 |
| CVE-2013-1881 | – | Oct 10 | GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference,… Affected: through 2.37.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.1.1; +34 more |
| CVE-2011-3146 | – | Sep 5 | librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and… Affected: through 2.34.0 |
Showing 10