1268239 – (CVE-2015-7557) CVE-2015-7557 librsvg2: Out-of-bounds heap read when parsing SVG file

Bug 1268239 (CVE-2015-7557) - CVE-2015-7557 librsvg2: Out-of-bounds heap read when parsing SVG file

Summary: CVE-2015-7557 librsvg2: Out-of-bounds heap read when parsing SVG file

Attachments	(Terms of Use)

Description Adam Mariš 2015-10-02 09:05:16 UTC

It was reported that out-of-band heap read is performed in librsvg2 when parsing SVG file.

Comment 2 Adam Mariš 2015-10-02 09:56:10 UTC

Acknowledgements:

Red Hat would like to thank Gustavo Grieco for reporting this issue.

Comment 3 Matthias Clasen 2015-10-02 14:14:28 UTC

I've downloaded the reproducer, and neither firefox 41 nor eog 3.18.0 crash. They both report errors trying to load the image.

Comment 4 Stefan Cornelius 2015-12-10 12:52:15 UTC

Upstream patch:
https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df

Comment 6 Adam Mariš 2015-12-21 13:53:11 UTC

Created librsvg2 tracking bugs for this issue:

Affects: fedora-all [bug 1293344]

Comment 7 Adam Mariš 2015-12-21 13:53:16 UTC

Created mingw-librsvg2 tracking bugs for this issue:

Affects: fedora-all [bug 1293345]

Note You need to log in before you can comment on or make changes to this bug.