CVE-2016-4348: Debian Linux

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.

Affected products

• Debian Debian Linux: version 8.0 only
• Gnome Librsvg: up to and including 2.40.1
• Opensuse Leap: version 42.1 only
• Opensuse Opensuse: version 13.2 only

Published 2016-05-20. Last modified 2026-06-17.