oss-sec mailing list archives
Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions
From: Adam Maris <amaris () redhat com>
Date: Mon, 6 Jun 2016 15:54:13 +0200
On 15/05/16 09:05, Gustavo Grieco wrote:
2016-05-11 0:36 GMT+02:00 Brian May <brian () linuxpenguins xyz>:Just did a git bisect against the source. Assuming I got this right, the following commits fixed the issue.Thanks for taking the time to do the git bisect!They affect the following functions: * rsvg_cairo_pop_discrete_layer - rsvg_cairo_pop_render_stack - rsvg_cairo_generate_mask: reproducible using circular-1.svgUse CVE-2016-4347.Fixed in: commit a51919f7e1ca9c535390a746fbf6e28c8402dc61 Author: Benjamin Otte <otte () redhat com> Date: Wed Oct 7 08:45:37 2015 +0200 rsvg: Add rsvg_acquire_node() This function does proper recursion checks when looking up resources from URLs and thereby helps avoiding infinite loops when cyclic references span multiple types of elements.I think CVE-2016-4347 and CVE-2015-7558 (stack exhaustion due to cyclic dependency, reported here: http://www.openwall.com/lists/oss-security/2015/12/21/5) are in fact, the same issue. This is probably my fault (sorry!). MITRE: We should reject the the newly assigned one? Regards, Gustavo.
CC'ing MITRE in case they missed this question. We confirm it is a duplication. Which CVE should be rejected? Thanks! -- Adam Mariš, Red Hat Product Security 1CCD 3446 0529 81E3 86AF 2D4C 4869 76E7 BEF0 6BC2
Current thread:
- CVE requests: DoS in librsvg parsing SVGs with circular definitions Gustavo Grieco (Apr 28)
- Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions cve-assign (Apr 28)
- Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions Gustavo Grieco (Apr 30)
- Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions Brian May (May 10)
- Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions Gustavo Grieco (May 15)
- Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions Adam Maris (Jun 06)
- Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions cve-assign (Jun 06)
- Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions cve-assign (Apr 28)