Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 11 May 2016 08:36:48 +1000
From: Brian May <brian@...uxpenguins.xyz>
To: gustavo.grieco@...il.com
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions

Just did a git bisect against the source. Assuming I got this right, the
following commits fixed the issue.

>> They affect the following functions:
>
>> * rsvg_cairo_pop_discrete_layer - rsvg_cairo_pop_render_stack -
>> rsvg_cairo_generate_mask: reproducible using circular-1.svg
>
> Use CVE-2016-4347.

Fixed in:

commit a51919f7e1ca9c535390a746fbf6e28c8402dc61
Author: Benjamin Otte <otte@...hat.com>
Date:   Wed Oct 7 08:45:37 2015 +0200

    rsvg: Add rsvg_acquire_node()
    
    This function does proper recursion checks when looking up resources
    from URLs and thereby helps avoiding infinite loops when cyclic
    references span multiple types of elements.


>> * _rsvg_css_normalize_font_size: reproducible using circular-2.svg
>
> Use CVE-2016-4348.

Fixed in:

commit d1c9191949747f6dcfd207831d15dd4ba00e31f2
Author: Benjamin Otte <otte@...hat.com>
Date:   Wed Oct 7 05:31:08 2015 +0200

    state: Store mask as reference
    
    Instead of immediately looking up the mask, store the reference and look
    it up on use.


This fix is two commits before the other commit.
-- 
Brian May <brian@...uxpenguins.xyz>
https://linuxpenguins.xyz/brian/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.