CVE-2015-7558 — Improper Input Validation in Librsvg

CWE-20 — Improper Input ValidationCWE-674 — Uncontrolled Recursion10 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.4%
top 19.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gnome LibrsvgDebian LibrsvgDebian Linux
Timeline
PublishedMay 20
Latest updateMay 17

Description

librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶crates.iognome/librsvg< 2.40.12
▶debiandebian/librsvg< librsvg 2.40.12-1 (bookworm)
▶Debiangnome/librsvg< 2.40.12-1+3
▶NVDgnome/librsvg2.40.11

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
librsvg DoS via Cyclic References↗2022-05-17
▶
OSV
librsvg DoS via Cyclic References↗2022-05-17
▶
OSV
CVE-2015-7558: librsvg before 2↗2016-05-20
▶

📋Vendor Advisories

3
Red Hat
librsvg2:↗2016-04-28
▶
Red Hat
librsvg2: Stack exhaustion causing DoS↗2015-12-21
▶
Debian
CVE-2015-7558: librsvg - librsvg before 2.40.12 allows context-dependent attackers to cause a denial of s...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-7558 mingw-librsvg2: librsvg2: Stack exhaustion causing DoS [fedora-all]↗2015-12-21
▶
Bugzilla
CVE-2015-7558 librsvg2: Stack exhaustion causing DoS [fedora-all]↗2015-12-21
▶
Bugzilla
CVE-2015-7558 librsvg2: Stack exhaustion causing DoS↗2015-10-02
▶
CVE-2015-7558 — Improper Input Validation in Librsvg | cvebase