GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade librsvg2Upgrade librsvg2-devel | Dec 1, 2016 | Oct 9, 2013 |
| Debian | — | Upgrade librsvg | Jul 30, 2024 | Oct 10, 2013 |
| Oracle_linux | — | Upgrade librsvg2-develUpgrade librsvg2 | Oct 16, 2024 | Oct 10, 2013 |
| Suse | — | Upgrade librsvg-2-2-32bitUpgrade gtk3Upgrade gdk-pixbuf-loader-rsvg-32bitUpgrade gtk3-immodule-ximUpgrade gdk-pixbuf-loader-rsvgUpgrade gtk3-immodule-multipressUpgrade librsvg-2-2Upgrade rsvg-viewUpgrade gtk3-tools-32bitUpgrade librsvg-x86Upgrade gtk3-immodule-multipress-32bitUpgrade gtk2-engine-svgUpgrade gtk3-immodule-amharic-32bitUpgrade gtk3-immodules-tigrignaUpgrade librsvg-32bitUpgrade libgtk-3-0-32bitUpgrade gtk3-immodule-thai-32bitUpgrade libgtk-3-0Upgrade gtk3-immodule-vietnameseUpgrade gtk3-toolsUpgrade gtk3-langUpgrade typelib-1_0-Gtk-3_0Upgrade gtk3-immodule-thaiUpgrade gtk3-immodule-inuktitut-32bitUpgrade librsvgUpgrade gtk3-immodule-amharicUpgrade gtk3-immodules-tigrigna-32bitUpgrade gtk3-immodule-xim-32bitUpgrade gtk3-devel-32bitUpgrade gtk2-engine-svg-32bitUpgrade sle-sdk-releaseUpgrade gtk3-immodule-inuktitutUpgrade typelib-1_0-Rsvg-2_0Upgrade gtk3-develUpgrade gtk3-dataUpgrade librsvg-develUpgrade gtk3-immodule-vietnamese-32bitUpgrade gtk3-branding-upstream | Dec 23, 2013 | Oct 9, 2013 |
| Ubuntu | — | Upgrade librsvg2-2Upgrade libgtk-3-0 | Nov 8, 2024 | Oct 10, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub