The remote NewStart CGSL host, running version MAIN 6.02, has librsvg2 packages installed that are affected by a vulnerability:

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4436-1 advisory.

    It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could     possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only     affected Ubuntu 16.04 LTS. (CVE-2017-11464)

    It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A     remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting     in a denial of service. (CVE-2019-20446)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0075 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-20446:
    In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4709 advisory.

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

    Security Fix(es):

    * librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1255:01 advisory.

    * librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0075 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-20446:
    In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in librsvg, an SVG rendering library. This update corrects some denial of service issues via exponential element processing, stack exhaustion or application crash when processing specially crafted files, as well as some memory safety issues.

For Debian 9 stretch, these problems have been fixed in version 2.40.21-0+deb9u1.

We recommend that you upgrade your librsvg packages.

For the detailed security status of librsvg please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/librsvg

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues:&#9; 

  - CVE-2019-20446: Fixed an issue where a crafted SVG file     with nested patterns can cause denial of service     (bsc#1162501). NOTE: Librsvg now has limits on the     number of loaded XML elements, and the number of     referenced elements within an SVG document. 

  - Fixed a stack exhaustion with circular references in     <use> elements.

  - Fixed a denial-of-service condition from exponential     explosion of rendered elements, through nested use of     SVG 'use' elements in malicious SVGs. 

This update was imported from the SUSE:SLE-15:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
147351	NewStart CGSL MAIN 6.02 : librsvg2 Vulnerability (NS-SA-2021-0065)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	medium
139024	Ubuntu 16.04 LTS / 18.04 LTS : librsvg vulnerabilities (USN-4436-1)	Nessus	Ubuntu Local Security Checks	2020/7/28	2025/9/3	high
236524	Alibaba Cloud Linux 3 : 0075: librsvg2 (ALINUX3-SA-2022:0075)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
142439	RHEL 8 : librsvg2 (RHSA-2020:4709)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/7	medium
294401	MiracleLinux 8 : librsvg2-2.42.7-4.0.1.el8 (AXSA:2021-1255:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
239450	TencentOS Server 3: librsvg2 (TSSA-2022:0075)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
184909	Rocky Linux 8 : librsvg2 (RLSA-2020:4709)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
138858	Debian DLA-2285-1 : librsvg security update	Nessus	Debian Local Security Checks	2020/7/23	2024/2/29	high
134619	openSUSE Security Update : librsvg (openSUSE-2020-343)	Nessus	SuSE Local Security Checks	2020/3/16	2024/3/21	medium

检测

插件搜索

medium

high

medium

medium

medium

medium

medium

high

medium