Gnome Librsvg vulnerabilities

10 CVEs affecting Gnome Librsvg, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-38633, published 2023-07-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-3146, published 2012-09-05. Medium severity, CVSS 6.8. EPSS: 4.4% chance of exploitation in the next 30 days. librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary…
CVE-2013-1881, published 2013-10-10. Medium severity, CVSS 4.3. EPSS: 3.2% chance of exploitation in the next 30 days. GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML…
CVE-2015-7558, published 2016-05-20. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.
CVE-2016-4348, published 2016-05-20. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an…
CVE-2023-38633, published 2023-07-22. Medium severity, CVSS 5.5. EPSS: 2.3% chance of exploitation in the next 30 days. A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as…
CVE-2018-1000041, published 2018-02-09. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM…
CVE-2019-20446, published 2020-02-02. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so…
CVE-2015-7557, published 2016-05-20. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of…
CVE-2016-6163, published 2017-02-03. Medium severity, CVSS 5.5. EPSS: 1.4% chance of exploitation in the next 30 days. The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file.
CVE-2017-11464, published 2017-07-19. High severity, CVSS 7.8. EPSS: 1.4% chance of exploitation in the next 30 days. A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.