[SECURITY] [DLA 395-1] librsvg security update

2016-01-1921:39:07

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.003

Percentile

68.9%

JSON

Package : librsvg
Version : 2.26.3-1+deb6u3
CVE ID : CVE-2015-7557

A vulnerability was found in LibRSVG, a library to render SVG graphics.
Librsvg was susceptible to an out-of-bounds heap read when parsing SVG
files.

For Debian 6 "Squeeze", this issue has been fixed in librsvg version
2.26.3-1+deb6u3. We recommend you to upgrade your librsvg packages.

Learn more about the Debian Long Term Support (LTS) Project and how to
apply these updates at: https://wiki.debian.org/LTS/
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian7powerpclibrsvg2-common< 2.36.1-2+deb7u1librsvg2-common_2.36.1-2+deb7u1_powerpc.deb
Debian7kfreebsd-amd64librsvg2-common< 2.36.1-2+deb7u1librsvg2-common_2.36.1-2+deb7u1_kfreebsd-amd64.deb
Debian7sparclibrsvg2-bin< 2.36.1-2+deb7u1librsvg2-bin_2.36.1-2+deb7u1_sparc.deb
Debian8mipslibrsvg2-bin< 2.40.5-1+deb8u1librsvg2-bin_2.40.5-1+deb8u1_mips.deb
Debian7s390xlibrsvg2-2< 2.36.1-2+deb7u1librsvg2-2_2.36.1-2+deb7u1_s390x.deb
Debian7mipsellibrsvg2-bin< 2.36.1-2+deb7u1librsvg2-bin_2.36.1-2+deb7u1_mipsel.deb
Debian8arm64librsvg2-dev< 2.40.5-1+deb8u1librsvg2-dev_2.40.5-1+deb8u1_arm64.deb
Debian8s390xlibrsvg2-dbg< 2.40.5-1+deb8u1librsvg2-dbg_2.40.5-1+deb8u1_s390x.deb
Debian6amd64librsvg2-bin< 2.26.3-1+deb6u3librsvg2-bin_2.26.3-1+deb6u3_amd64.deb
Debian7amd64librsvg2-dbg< 2.36.1-2+deb7u1librsvg2-dbg_2.36.1-2+deb7u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	powerpc	librsvg2-common	< 2.36.1-2+deb7u1	librsvg2-common_2.36.1-2+deb7u1_powerpc.deb
Debian	7	kfreebsd-amd64	librsvg2-common	< 2.36.1-2+deb7u1	librsvg2-common_2.36.1-2+deb7u1_kfreebsd-amd64.deb
Debian	7	sparc	librsvg2-bin	< 2.36.1-2+deb7u1	librsvg2-bin_2.36.1-2+deb7u1_sparc.deb
Debian	8	mips	librsvg2-bin	< 2.40.5-1+deb8u1	librsvg2-bin_2.40.5-1+deb8u1_mips.deb
Debian	7	s390x	librsvg2-2	< 2.36.1-2+deb7u1	librsvg2-2_2.36.1-2+deb7u1_s390x.deb
Debian	7	mipsel	librsvg2-bin	< 2.36.1-2+deb7u1	librsvg2-bin_2.36.1-2+deb7u1_mipsel.deb
Debian	8	arm64	librsvg2-dev	< 2.40.5-1+deb8u1	librsvg2-dev_2.40.5-1+deb8u1_arm64.deb
Debian	8	s390x	librsvg2-dbg	< 2.40.5-1+deb8u1	librsvg2-dbg_2.40.5-1+deb8u1_s390x.deb
Debian	6	amd64	librsvg2-bin	< 2.26.3-1+deb6u3	librsvg2-bin_2.26.3-1+deb6u3_amd64.deb
Debian	7	amd64	librsvg2-dbg	< 2.36.1-2+deb7u1	librsvg2-dbg_2.36.1-2+deb7u1_amd64.deb