Bug 3581

Summary: Security Advisory - librsvg - CVE-2011-3146
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Li Wang <li.wang>
Component: graphicsAssignee: Li Wang <li.wang>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium+ CC: jessica.zhang, meta.mr.watcher, meta.watcher, sgw, song.liu, zhenfeng.zhao
Version: 1.4   
Target Milestone: Future   
Hardware: x86   
OS: Multiple   
Whiteboard: P3
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: ---

Description Li Wang 2012-12-13 06:48:52 UTC 
librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with fe, which is misidentified as a RsvgFilterPrimitive.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3146