{"id":"CVE-2013-1881","aliases":["DEBIAN-CVE-2013-1881","EUVD-2013-1880","GHSA-w223-x3f9-926w","MGASA-2014-0004","RHSA-2014:0127","SUSE-SU-2015:1785-1","openSUSE-SU-2024:10229-1"],"status":"published","title":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document...","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03197,"percentile":0.88206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-10-10T00:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"librsvg","fixed_in":["2.40.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librsvg","fixed_in":["2.40.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librsvg","fixed_in":["2.40.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"librsvg","fixed_in":["2.36.4-2.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"gtk+3.0","fixed_in":["gtk+3.0-3.6.4-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"librsvg2","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"librsvg2-debuginfo","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"librsvg2-devel","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librsvg2","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librsvg2-debuginfo","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librsvg2-devel","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"librsvg2","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"librsvg2-debuginfo","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"librsvg2-devel","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librsvg2","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librsvg2-debuginfo","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librsvg2-devel","fixed_in":["0:2.26.0-6.el6_5.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"librsvg","fixed_in":["2.26.0-2.5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.4-2.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"gtk+3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"gtk+3.0-3.6.4-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26.0-6.el6_5.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-2.5.1"}]}]}],"products":[{"vendor":"gnome","product":"librsvg"}],"references":[{"url":"http://ftp.gnome.org/pub/GNOME/sources/librsvg/2.39/librsvg-2.39.0.changes","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=691708","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://secunia.com/advisories/55088","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2149-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0127.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://en.securitylab.ru/lab/PT-2013-01","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-11/msg00114.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2149-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1881","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w223-x3f9-926w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1881","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0004.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11853","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0127","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=924414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0127.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1881","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151785-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/840753","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1881","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3146","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-1881","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-10-10T00:00:00Z","modified":"2024-08-06T15:20:36.945Z","updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2013-1880","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-10-10T00:00:00Z","modified":"2024-08-06T15:20:36Z","updated_at":"2026-11-03T01:56:40.540333Z"}],"ghsa":[{"id":"GHSA-w223-x3f9-926w","title":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document...","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2022-05-17T03:23:26Z","modified":"2023-01-27T05:06:52Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:00.384551Z"}],"nvd":[{"id":"CVE-2013-1881","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-10-10T00:55:03.773Z","modified":"2026-06-16T23:52:17.877Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"CVE-2013-1881","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-10-10T00:55:03Z","modified":"2026-04-16T06:18:28.996279592Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1881","description":"GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-10-10T00:55:03.773Z","modified":"2026-09-01T20:03:15.092024879Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2014-0004","title":"Updated librsvg and gtk+3.0 packages fix security vulnerability","description":"librsvg before version 2.39.0 allows remote attackers to read arbitrary files\nvia an XML document containing an external entity declaration in conjunction\nwith an entity reference (CVE-2013-1881).\n\ngtk+3.0 has been patched to cope with the changes in SVG loading due to the\nfix in librsvg.\n","status":"published","published":"2014-01-06T01:08:20Z","modified":"2026-04-16T06:24:26.401506737Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10229-1","title":"gdk-pixbuf-loader-rsvg-2.40.16-1.4 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.40.16-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:02.085981Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:0127","title":"Red Hat Security Advisory: librsvg2 security update","status":"published","published":"2024-09-15T21:17:09Z","modified":"2026-06-26T10:23:17Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2015:1785-1","title":"Security update for librsvg","description":"librsvg was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2013-1881: GNOME libsvg allowed remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (bsc#840753).\n  ","status":"published","published":"2015-10-12T08:30:54Z","modified":"2025-05-02T04:03:55.912648Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}