Code injection

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG...

CVE-2019-12921

GraphicsMagick (before 1.3.32) is affected by CVE-2019-12921 where the text filename component could read arbitrary files via TranslateTextEx in SVG processing. OpenSUSE and Debian advisories explicitly reference CVE-2019-12921 alongside CVE-2020-10938, with patches to fix the issues (e.g., updat...

CVE-2019-12921

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG...

CVE-2019-12921

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG...

CVE-2019-12921

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG...

PT-2020-6203 · Graphicsmagick +4 · Graphicsmagick +4

Name of the Vulnerable Software and Affected Versions: GraphicsMagick versions prior to 1.3.32 Description: The issue is related to information disclosure, allowing remote attackers to read arbitrary files via a crafted image because of the TranslateTextEx function for SVG. This can lead to...

The vulnerability of the svg-vector-icon-plugin (WP SVG Icons) plugin for WordPress content management systems allows a hacker to upload a arbitrary ZIP archive (containing a.php file).

The vulnerability of the svg-vector-icon-plugin WP SVG Icons plugin for WordPress lies in insufficient validation of the requests being made. Exploiting this vulnerability could allow a malicious actor to download a arbitrary ZIP archive containing a.php file remotely...

GLSA-202003-11 : SVG Salamander: Server-Side Request Forgery

The remote host is affected by the vulnerability described in GLSA-202003-11 SVG Salamander: Server-Side Request Forgery A Server-Side Request Forgery was discovered in SVG Salamander. Impact : An attacker, by sending a specially crafted SVG file, can conduct SSRF. Workaround : There is no known...

openSUSE Security Update : librsvg (openSUSE-2020-343)

This update for librsvg to version 2.42.8 fixes the following issues : librsvg was updated to version 2.42.8 fixing the following issues: - CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the numb...

openSUSE: Security Advisory for librsvg (openSUSE-SU-2020:0343-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0343-1 Security update for librsvg

This update for librsvg to version 2.42.8 fixes the following issues: librsvg was updated to version 2.42.8 fixing the following issues: - CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the numbe...

Security update for librsvg (moderate)

openSUSE Security Update: Security update for librsvg Announcement ID: openSUSE-SU-2020:0343-1 Rating: moderate References: 1162501 Cross-References: CVE-2019-20446 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for librsvg ...

SVG Salamander: Server-Side Request Forgery

Background SVG Salamander is a light weight SVG renderer and animator for Java. Description A Server-Side Request Forgery was discovered in SVG Salamander. Impact An attacker, by sending a specially crafted SVG file, can conduct SSRF. Workaround There is no known workaround at this time. Resoluti...

EulerOS Virtualization for ARM 64 3.0.2.0 : cairo (EulerOS-SA-2020-1260)

According to the versions of the cairo packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Cairo is a 2D graphics library designed to provide high-quality display and print output. Currently supported output...

SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-1)

This update for librsvg to version 2.42.8 fixes the following issues : librsvg was updated to version 2.42.8 fixing the following issues : CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the numbe...

SUSE SLES12 Security Update : librsvg (SUSE-SU-2020:0604-1)

This update for librsvg to version 2.40.21 fixes the following issues : librsvg was updated to version 2.40.21 fixing the following issues : CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the...

SUSE-SU-2020:0604-1 Security update for librsvg

This update for librsvg to version 2.40.21 fixes the following issues: librsvg was updated to version 2.40.21 fixing the following issues: - CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the...

FreeBSD : librsvg2 -- multiple vulnabilities (b66583ae-5aee-4cd5-bb31-b2d397f8b6b3)

Librsvg2 developers reports : Backport the following fixes from 2.46.x : Librsvg now has limits on the number of loaded XML elements, and the number of referenced elements within an SVG document. This is to mitigate malicious SVGs which try to consume all memory, and those which try to consume an...

DRUPAL-CONTRIB-2020-005

SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab. This vulnerability is mitigated by the fact that an attacker must be able to upload SVG fil...

SVG Formatter - Critical - Cross site scripting - SA-CONTRIB-2020-005

SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab. This vulnerability is mitigated by the fact that an attacker must be able to upload SVG fil...