CVEvulnerability

CVE-2019-20446

6.5 MEDIUM Published 2020-02-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-400

Description

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.

Affected configurations

• gnome librsvg (< 2.40.21) • gnome librsvg (>= 2.42.0 < 2.42.8) • gnome librsvg (>= 2.44.0 < 2.44.16) • opensuse leap 15.1 • fedoraproject fedora 30 • fedoraproject fedora 31 • debian debian linux 9.0 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • netapp active iq unified manager

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References