Bug 3581 - Security Advisory - librsvg - CVE-2011-3146
Summary: Security Advisory - librsvg - CVE-2011-3146
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: graphics (show other bugs)
Version: 1.4
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: Future
Assignee: Li Wang
QA Contact:
URL:
Whiteboard: P3
Depends on:
Blocks:
 
Reported: 2012-12-13 06:48 UTC by Li Wang
Modified: 2013-02-28 19:30 UTC (History)
6 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Li Wang 2012-12-13 06:48:52 UTC 
librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with fe, which is misidentified as a RsvgFilterPrimitive.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3146