SB2016052004 - Debian update for librsvg
Published: May 20, 2016 Updated: February 1, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Resource management error (CVE-ID: CVE-2016-4348)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to stack consumption in the _rsvg_css_normalize_font_size() function in librsvg when processing circular definitions in an SVG document. A remote attacker can use a specially crafted SVG file and consume all available resources on the system.
2) Infinite loop (CVE-ID: CVE-2015-7558)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing cyclic references in an SVG document. A remote attacker can use a specially crafted SVG file to consume all available system resources and cause denial of service conditions.
Remediation
Install update from vendor's website.