CVE-2016-4348 — Improper Input Validation in Librsvg

CWE-20 — Improper Input ValidationCWE-674 — Uncontrolled Recursion8 documents6 sources
Severity
7.5HIGHNVD
EPSS
3.1%
top 13.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Gnome LibrsvgDebian LibrsvgDebian Linux+2 more
Timeline
PublishedMay 20
Latest updateMay 14

Description

The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/librsvg< librsvg 2.40.12-1 (bookworm)
▶Debiangnome/librsvg< 2.40.12-1+3
▶NVDgnome/librsvg2.40.1
▶NVDopensuse/leap42.1

Also affects: Debian Linux 8.0

🔴Vulnerability Details

2
GHSA
GHSA-7wvm-3hhw-ch57: The _rsvg_css_normalize_font_size function in librsvg 2↗2022-05-14
▶
OSV
CVE-2016-4348: The _rsvg_css_normalize_font_size function in librsvg 2↗2016-05-20
▶

📋Vendor Advisories

2
Red Hat
librsvg2: DoS parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function↗2016-04-28
▶
Debian
CVE-2016-4348: librsvg - The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-depe...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-4347 CVE-2016-4348 librsvg2: various flaws [fedora-all]↗2016-04-29
▶
Bugzilla
CVE-2016-4347 CVE-2016-4348 mingw-librsvg2: various flaws [fedora-all]↗2016-04-29
▶
Bugzilla
CVE-2016-4348 librsvg2: DoS parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function↗2016-04-29
▶
CVE-2016-4348 — Improper Input Validation in Librsvg | cvebase