Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1qOTg0LXE0cWMtNnF4Zs4AAdNg

librsvg DoS via Cyclic References

librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.

Permalink: https://github.com/advisories/GHSA-j984-q4qc-6qxf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qOTg0LXE0cWMtNnF4Zs4AAdNg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00305
EPSS Percentile: 0.705

Identifiers: GHSA-j984-q4qc-6qxf, CVE-2015-7558
References: Blast Radius: 2.3

Affected Packages

cargo:librsvg
Dependent packages: 2
Dependent repositories: 2
Downloads: 33,867 total
Affected Version Ranges: < 2.40.12
Fixed in: 2.40.12
All affected versions:
All unaffected versions: 2.56.0, 2.56.92, 2.57.0, 2.57.1, 2.57.2, 2.57.3, 2.58.0, 2.58.1, 2.58.2, 2.58.3, 2.58.4, 2.58.5, 2.59.0, 2.59.1, 2.59.2