CVE-2017-11464

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during...

7.8 HighFix available

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.39%Down 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: CVE-2017-11464
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-369
Updated: 2026-11-02

CVE List No score

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: CVE-2017-11464
Updated: 2026-11-02

EUVDEUVD-2017-3085 No score

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: EUVD-2017-3085
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p53g-qpqr-rqmg 7.8

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during...

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: GHSA-p53g-qpqr-rqmg
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-369
Updated: 2026-11-02

OSV 7.8

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: CVE-2017-11464
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-11464 7.8

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: DEBIAN-CVE-2017-11464
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2017-11464 7.8

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.

Record: UBUNTU-CVE-2017-11464
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2017-0247 No score

Updated librsvg packages fix security vulnerability

Division-by-zero in the Gaussian blur code (CVE-2017-11464).

Record: MGASA-2017-0247
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10986-1 No score

gdk-pixbuf-loader-rsvg-2.50.7-1.5 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.50.7-1.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10986-1
Updated: 2026-11-02

OSVSUSE-SU-2017:2117-1 No score

Security update for librsvg

This update librsvg to version 2.40.18 fixes the following issues:

Security issue fixed:

CVE-2017-11464: A SIGFPE is raised in the function box_blur_line of rsvg-filter.c. (bsc#1049607)

Record: SUSE-SU-2017:2117-1
Updated: 2026-11-02

OSVUSN-4436-1 No score

librsvg vulnerabilities

It was discovered that librsvg incorrectly handled parsing certain SVG files. A remote attacker could possibly use this issue to cause librsvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11464)

It was discovered that librsvg incorrectly handled parsing certain SVG files with nested patterns. A remote attacker could possibly use this issue to cause librsvg to consume resources and crash, resulting in a denial of service. (CVE-2019-20446)

Record: USN-4436-1
Updated: 2026-11-02

Affected products

gnome librsvg

Affected packages

Affected packages
Package	Affected	Fixed
`librsvg` Debian:12	before 2.40.18-1	2.40.18-1
`librsvg` Debian:13	before 2.40.18-1	2.40.18-1
`librsvg` Debian:14	before 2.40.18-1	2.40.18-1
`librsvg` Debian:9 From an advisory covering 2 CVEs	before 2.40.21-0+deb9u1, plus listed versions 2.40.16-12.40.16-22.40.18-12.40.18-22.40.18-3 Show 7 moreShow less 2.40.20-12.40.20-22.40.20-32.40.20-3+0.riscv64.12.40.20-3+ports2.40.20-3.02.40.20-3.0~hurd.2	2.40.21-0+deb9u1
`librsvg` Mageia:5	before 2.40.18-1.mga5	2.40.18-1.mga5
`librsvg` Mageia:6	before 2.40.18-1.mga6	2.40.18-1.mga6
`librsvg` SUSE:Linux Enterprise Desktop 12 SP2	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Desktop 12 SP3	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Software Development Kit 12 SP2	before 2.40.18-5.3.1	2.40.18-5.3.1

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`librsvg` SUSE:Linux Enterprise Software Development Kit 12 SP3	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Server 12 SP2	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Server 12 SP3	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	before 2.40.18-5.3.1	2.40.18-5.3.1
`librsvg` Ubuntu:16.04:LTS	before 2.40.13-3ubuntu0.1, plus listed versions 2.40.10-12.40.11-12.40.11-22.40.12-12.40.13-12.40.13-22.40.13-3	2.40.13-3ubuntu0.1
`librsvg` Ubuntu:16.04:LTS From an advisory covering 2 CVEs	before 2.40.13-3ubuntu0.1, plus listed versions 2.40.10-12.40.11-12.40.11-22.40.12-12.40.13-12.40.13-22.40.13-3	2.40.13-3ubuntu0.1
`librsvg` Ubuntu:18.04:LTS From an advisory covering 2 CVEs	before 2.40.20-2ubuntu0.1, plus listed versions 2.40.18-12.40.18-22.40.20-2	2.40.20-2ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11464 is a high vulnerability (CVSS 7.8) in Gnome Librsvg, published July 19, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in librsvg 2.40.18-1.

References

Show 16 moreShow less