CVE-2015-7557
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context...
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
CVE-2015-7557- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
CVE-2015-7557- Updated
- 2026-11-02
EUVDEUVD-2015-7471 No score
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
EUVD-2015-7471- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-25xx-qj5q-8gm9
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context...
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
GHSA-25xx-qj5q-8gm9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
CVE-2015-7557- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7557
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
DEBIAN-CVE-2015-7557- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7557
The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.
- Record
UBUNTU-CVE-2015-7557- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0021 No score
Updated librsvg packages fix security vulnerability
Out-of-bounds heap read in librsvg2 was found when parsing SVG file (CVE-2015-7557).
Stack exhaustion due to cyclic dependency causing to crash an application was found in librsvg2 while parsing SVG file (CVE-2015-7558).
The librsvg package has been updated to version 2.40.13, fixing these issues and several other bugs. See the upstream NEWS file for details.
- Record
MGASA-2016-0021- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
librsvgDebian:12 |
before 2.40.9-2 | 2.40.9-2 |
librsvgDebian:13 |
before 2.40.9-2 | 2.40.9-2 |
librsvgDebian:14 |
before 2.40.9-2 | 2.40.9-2 |
librsvgDebian:6.0 |
before 2.26.3-1+deb6u3, plus listed versions 2.26.3-1 |
2.26.3-1+deb6u3 |
librsvgMageia:5 |
before 2.40.13-1.mga5 | 2.40.13-1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7557 is a high vulnerability (CVSS 7.5) in Gnome Librsvg, published January 15, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.03%, the 81st percentile. Fixed in librsvg 2.40.9-2.
References
openwall.com/lists/oss-security/2015/12/21/5
git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df
nvd.nist.gov/vuln/detail/CVE-2015-7557
github.com/advisories/GHSA-25xx-qj5q-8gm9
security-tracker.debian.org/tracker/CVE-2015-7557