CVE-2015-7557 — Improper Input Validation in Librsvg

CWE-20 — Improper Input ValidationCWE-122 — Heap-based Buffer OverflowCWE-125 — Out-of-bounds Read9 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 33.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gnome LibrsvgDebian Librsvg
Timeline
PublishedMay 20
Latest updateMay 17

Description

The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/librsvg< librsvg 2.40.9-2 (bookworm)
▶Debiangnome/librsvg< 2.40.9-2+3
▶NVDgnome/librsvg2.40.6

🔴Vulnerability Details

2
GHSA
GHSA-25xx-qj5q-8gm9: The _rsvg_node_poly_build_path function in rsvg-shapes↗2022-05-17
▶
OSV
CVE-2015-7557: The _rsvg_node_poly_build_path function in rsvg-shapes↗2016-05-20
▶

💥Exploits & PoCs

1
Exploit-DB
Wireshark - dissct_rsl_ipaccess_msg Static Out-of-Bounds Read↗2015-12-16
▶

📋Vendor Advisories

2
Red Hat
librsvg2: Out-of-bounds heap read when parsing SVG file↗2015-12-21
▶
Debian
CVE-2015-7557: librsvg - The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40....↗2015
▶

💬Community

3
Bugzilla
CVE-2015-7557 mingw-librsvg2: librsvg2: Out-of-band heap read when parsing SVG file [fedora-all]↗2015-12-21
▶
Bugzilla
CVE-2015-7557 librsvg2: Out-of-band heap read when parsing SVG file [fedora-all]↗2015-12-21
▶
Bugzilla
CVE-2015-7557 librsvg2: Out-of-bounds heap read when parsing SVG file↗2015-10-02
▶
CVE-2015-7557 — Improper Input Validation in Librsvg | cvebase