The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1255:01 advisory.

    * librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4436-1 advisory.

    It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could     possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only     affected Ubuntu 16.04 LTS. (CVE-2017-11464)

    It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A     remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting     in a denial of service. (CVE-2019-20446)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4709 advisory.

  - librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for librsvg to version 2.40.21 fixes the following issues :

librsvg was updated to version 2.40.21 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.
</use>

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.
</use>

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues :

CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service (bsc#1162501). NOTE: Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document.

Fixed a stack exhaustion with circular references in <use> elements.

Fixed a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG 'use' elements in malicious SVGs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4709 advisory.

    [2.42.7-4]
    - Resolves: rhbz#1804519 Add patch for CVE-2019-20446

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Librsvg2 developers reports :

Backport the following fixes from 2.46.x :

Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document. This is to mitigate malicious SVGs which try to consume all memory, and those which try to consume an exponential amount of CPU time.

Fix stack exhaustion with circular references in <use> elements.

Fix a denial-of-service condition from exponential explosion of rendered elements, through nested use of SVG <use> elements in malicious SVGs. This is similar to the XML 'billion laughs attack' but for SVG instancing.

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for librsvg to version 2.42.8 fixes the following issues :

librsvg was updated to version 2.42.8 fixing the following issues:&#9; 

  - CVE-2019-20446: Fixed an issue where a crafted SVG file     with nested patterns can cause denial of service     (bsc#1162501). NOTE: Librsvg now has limits on the     number of loaded XML elements, and the number of     referenced elements within an SVG document. 

  - Fixed a stack exhaustion with circular references in     <use> elements.

  - Fixed a denial-of-service condition from exponential     explosion of rendered elements, through nested use of     SVG 'use' elements in malicious SVGs. 

This update was imported from the SUSE:SLE-15:Update update project.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bdac753c-d1d5-11f1-985e-901b0edee044 advisory.

    Dinu Gherman reports:
    The SVG <path> elliptical-arc parser in             svglib.utils.split_arc_values() builds a regex with multiple empty-matchable             float groups and two mandatory flag groups, then runs it under re.finditer().
            An arc argument that is a long run of digits (containing no 0/1 where a flag is             expected) triggers catastrophic backtracking whose cost grows exponentially             (~2x per ~4 extra digits). Reachable from any untrusted SVG via svg2rlg /             svg2pdf.
    svg2rlg() expands <use> references without any limit on the             total number of expansions. Only direct cycles are rejected (CircularRefError).
            A group containing N <use> elements that point to another such group             multiplies the work by N per nesting level, so an SVG of about 1.4 KB makes             svglib clone and render over 100,000 nodes, taking tens of seconds of CPU time             and hundreds of MiB of memory. Each additional level adds about 245 bytes to             the document and multiplies time by ~10.

            This is the SVG <use> variant of the XML billion laughs attack (the             same class as librsvg CVE-2019-20446).
    svglib converts SVG into ReportLab drawings / PDF / PNG (svg2rlg).
            When it renders an or element, SvgRenderer.xlink_href_target() resolves the             element's xlink:href / href to a local file path and embeds that file into the             output. The resolution joins the attacker-controlled reference onto the SVG's             own directory with os.path.join() and performs no containment check.  Because             os.path.join(base, iri) discards base the moment iri is absolute, and ..
            segments collapse above base, a crafted SVG can name any file the rendering             process can read. If that file decodes as a raster image (any extension) its             bytes are copied verbatim into the output; if it is an XML-parseable .svg its             rendered content, text included, is inlined. The result is arbitrary local file             read against a service that converts untrusted SVGs from a file path. This is a             different class and a different code path from the 2020 XXE (CVE-2020-10799,             fixed in 0.9.4).

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in librsvg, an SVG rendering library. This update corrects some denial of service issues via exponential element processing, stack exhaustion or application crash when processing specially crafted files, as well as some memory safety issues.

For Debian 9 stretch, these problems have been fixed in version 2.40.21-0+deb9u1.

We recommend that you upgrade your librsvg packages.

For the detailed security status of librsvg please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/librsvg

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
294401	MiracleLinux 8 : librsvg2-2.42.7-4.0.1.el8 (AXSA:2021-1255:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
139024	Ubuntu 16.04 LTS / 18.04 LTS : librsvg vulnerabilities (USN-4436-1)	Nessus	Ubuntu Local Security Checks	2020/7/28	2025/9/3	high
145915	CentOS 8 : librsvg2 (CESA-2020:4709)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	medium
134351	SUSE SLES12 Security Update : librsvg (SUSE-SU-2020:0604-1)	Nessus	SuSE Local Security Checks	2020/3/9	2024/3/25	medium
134400	SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-1)	Nessus	SuSE Local Security Checks	2020/3/11	2024/3/22	medium
138257	SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-2)	Nessus	SuSE Local Security Checks	2020/7/9	2020/12/7	medium
157664	AlmaLinux 8 : librsvg2 (ALSA-2020:4709)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	medium
142798	Oracle Linux 8 : librsvg2 (ELSA-2020-4709)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/11/2	medium
134257	FreeBSD : librsvg2 -- multiple vulnabilities (b66583ae-5aee-4cd5-bb31-b2d397f8b6b3)	Nessus	FreeBSD Local Security Checks	2020/3/6	2024/3/25	medium
134718	Fedora 31 : chromium (2020-f6271d7afa)	Nessus	Fedora Local Security Checks	2020/3/20	2022/12/6	high
134990	Fedora 30 : chromium (2020-39e0b8bd14)	Nessus	Fedora Local Security Checks	2020/3/30	2022/12/6	high
222814	Linux Distros Unpatched Vulnerability : CVE-2019-20446	Nessus	Misc.	2025/3/4	2026/11/5	medium
134619	openSUSE Security Update : librsvg (openSUSE-2020-343)	Nessus	SuSE Local Security Checks	2020/3/16	2024/3/21	medium
372882	FreeBSD : py-svglib -- Multiple vulnerabilities (bdac753c-d1d5-11f1-985e-901b0edee044)	Nessus	FreeBSD Local Security Checks	2026/10/28	2026/10/28	critical
138858	Debian DLA-2285-1 : librsvg security update	Nessus	Debian Local Security Checks	2020/7/23	2024/2/29	high

检测

插件搜索

medium

high

medium

medium

medium

medium

medium

medium

medium

high

high

medium

medium

critical

high