USN-8891-1: librsvg vulnerability
Ubuntu reports a librsvg flaw that may allow denial of service or arbitrary code execution.
Ubuntu Security Notice USN-8891-1 describes a vulnerability in librsvg. The library incorrectly handled duplicate XML entity declarations while processing SVG documents that contain nested XML inclusions. An attacker could possibly use the issue to cause a denial of service or execute arbitrary code. The notice does not cite a CVE identifier or report exploitation in the wild.
- librsvg mishandles duplicate XML entity declarations in SVG documents.
- Nested XML inclusions can trigger the vulnerable processing path.
- Impact may include denial of service or arbitrary code execution.
- USN-8891-1 cites no CVE and reports no active exploitation.
It was discovered that librsvg incorrectly handled duplicate XML entity declarations while processing SVG documents containing nested XML inclusions. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
This source does not provide full text. Read it at ubuntu.com.