UBUNTU-CVE-2015-4518

The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy CSP protection mechanism and conduct cross-site scripting XSS attacks via vectors involving SVG animations and the about:reader...

[SECURITY] Fedora 21 Update: batik-1.8-0.18.svn1230816.fc21

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

[SECURITY] Fedora 20 Update: batik-1.8-0.12.svn1230816.fc20

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

[SECURITY] Fedora 22 Update: batik-1.8-0.18.svn1230816.fc22

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

chromium-browser: Use-after-free in SVG.

Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element...

chromium-browser: Container-overflow in SVG.

platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service container overflow or...

Google Chrome Blink SVG Memory Misreference Vulnerability

Blink is a browser typography engine developed by Google and Opera Software. A memory misreference vulnerability exists in the SVG implementation of Blink used by Google Chrome. As the program fails to properly handle the shadow tree of use elements. A remote attacker could exploit this...

UBUNTU-CVE-2015-1257

platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service container overflow or...

USN-2603-1 thunderbird vulnerabilities

Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application...

Microsoft Internet Explorer SVG Marker Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

MediaWiki Incomplete Blacklist Vulnerability (CNVD-2015-02418)

MediaWiki is a Wiki program. An incomplete blacklist vulnerability exists in the includes/upload/UploadBase.php script of MediaWiki. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of nested SVG files with data: URI of type pplication/xml MIME...

MediaWiki HTML Injection Vulnerability

MediaWiki is a Wiki program. A security vulnerability exists in MediaWiki, which stems from the failure of the 'xmlparse' function in the Zend interpreter to properly expand entities. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of a...

MediaWiki Information Disclosure Vulnerability (CNVD-2015-02411)

MediaWiki is a Wiki program. A security vulnerability exists in MediaWiki. A remote attacker can exploit this vulnerability to bypass SVG filtering and obtain sensitive user information via a mixed-case '@import' string in the style element of an SVG file...

DEBIAN-CVE-2015-2931

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI...

UBUNTU-CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

UBUNTU-CVE-2015-2942

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service CPU and memory consumption via a large number of nested entity references in an 1 SVG file or 2 XMP metadata in a PDF file, aka a "billion laughs attack," ...

USN-2548-1 batik vulnerability

Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files or cause resource consumption...

Apache Batik Information Disclosure Vulnerability

Apache Batik is a Java-based technology SVG Scalable Vector Graphics toolkit , you can view , generate and process SVG format images . Apache Batik has a security vulnerability that can be exploited by attackers to send malicious SVG files and obtain sensitive information...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via unsafe svg animation tags. Details Exploit Example: html Here the anchor's href is animated, starting from a value that's a javascript URI. This allows execution of arbitrary javascript in the process...

Mozilla: Out-of-bounds read and write while rendering SVG content (MFSA 2015-19)

Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic...