CVE-2011-3146

Publication date 6 September 2011

Last updated 24 July 2024

Ubuntu priority

librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with “fe,” which is misidentified as a RsvgFilterPrimitive.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
librsvg	11.04 natty	Fixed 2.32.1-0ubuntu3.1
	10.10 maverick	Fixed 2.32.0-0ubuntu1.1
	10.04 LTS lucid	Fixed 2.26.3-0ubuntu1.1
	8.04 LTS hardy	Ignored end of life

How can I get the fixes?
What do statuses mean?

Notes

jdstrand

patch and discussion in linux-distros@vs.openwall.org

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-1206-1
librsvg vulnerability
13 September 2011

Other references

https://www.cve.org/CVERecord?id=CVE-2011-3146