[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87d1otk0an.fsf@prune.linuxpenguins.xyz>
Date: Wed, 11 May 2016 08:36:48 +1000
From: Brian May <brian@...uxpenguins.xyz>
To: gustavo.grieco@...il.com
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions
Just did a git bisect against the source. Assuming I got this right, the
following commits fixed the issue.
>> They affect the following functions:
>
>> * rsvg_cairo_pop_discrete_layer - rsvg_cairo_pop_render_stack -
>> rsvg_cairo_generate_mask: reproducible using circular-1.svg
>
> Use CVE-2016-4347.
Fixed in:
commit a51919f7e1ca9c535390a746fbf6e28c8402dc61
Author: Benjamin Otte <otte@...hat.com>
Date: Wed Oct 7 08:45:37 2015 +0200
rsvg: Add rsvg_acquire_node()
This function does proper recursion checks when looking up resources
from URLs and thereby helps avoiding infinite loops when cyclic
references span multiple types of elements.
>> * _rsvg_css_normalize_font_size: reproducible using circular-2.svg
>
> Use CVE-2016-4348.
Fixed in:
commit d1c9191949747f6dcfd207831d15dd4ba00e31f2
Author: Benjamin Otte <otte@...hat.com>
Date: Wed Oct 7 05:31:08 2015 +0200
state: Store mask as reference
Instead of immediately looking up the mask, store the reference and look
it up on use.
This fix is two commits before the other commit.
--
Brian May <brian@...uxpenguins.xyz>
https://linuxpenguins.xyz/brian/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
