{"id":"CVE-2018-1000041","aliases":["DEBIAN-CVE-2018-1000041","DLA-1278-1","EUVD-2018-1802","GHSA-8xg7-956h-4q23","MGASA-2018-0291","MGASA-2018-0297","SUSE-SU-2018:1288-1"],"status":"published","title":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper...","description":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02197,"percentile":0.82611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-02-09T23:00:00Z","modified":"2026-10-24T14:05:27Z","fixes":[{"ecosystem":"Debian:7","package":"librsvg","fixed_in":["2.36.1-2+deb7u3"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"librsvg","fixed_in":["2.40.18-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"librsvg","fixed_in":["2.40.18-1.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"librsvg","fixed_in":["2.40.20-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"librsvg","fixed_in":["2.40.20-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"librsvg","fixed_in":["2.40.20-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"librsvg","fixed_in":["2.40.20-5.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.1-2+deb7u3"}]}],"versions":["2.36.1-1","2.36.1-2","2.36.1-2+deb7u1","2.36.1-2+deb7u2"]},{"source":"osv","ecosystem":"Mageia:6","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.18-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.18-1.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.20-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.20-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.20-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.20-5.6.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnome","product":"librsvg"}],"references":[{"url":"https://github.com/ImageMagick/librsvg/commit/f9d69eadd2b16b00d1a1f9f286122123f8e547dd","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/GNOME/librsvg/commit/c6ddf2ed4d768fd88adbea2b63f575cd523022ea","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000041"},{"url":"https://github.com/advisories/GHSA-8xg7-956h-4q23"},{"url":"https://advisories.mageia.org/MGASA-2018-0291.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23144","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-05/msg00045.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0297.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23206","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181288-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083232","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000041","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000041","description":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:48.985Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1802","description":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:48Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-8xg7-956h-4q23","title":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper...","description":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.","status":"published","published":"2022-05-13T01:48:30Z","modified":"2023-02-02T05:01:44Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:15.131458Z"}],"nvd":[{"id":"CVE-2018-1000041","description":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.","status":"published","published":"2018-02-09T23:29:01.26Z","modified":"2026-06-17T01:32:17.863Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-1000041","description":"GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.","status":"published","published":"2018-02-09T23:29:01.26Z","modified":"2026-10-24T14:05:27.153256271Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DLA-1278-1","title":"librsvg - security update","status":"published","published":"2018-02-12T00:00:00Z","modified":"2026-03-09T01:02:02.069962Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2018-0291","title":"Updated librsvg packages fix a security vulnerability","description":"Updated librsvg package fixes security vulnerability:\n\nIt was discovered that there was an input validation vulnerability in the \nlibrsvg renderer library that could result in data being leaked to remote \nattackers via a specially-crafted file (CVE-2018-1000041).\n","status":"published","published":"2018-06-19T23:42:28Z","modified":"2026-04-16T06:26:12.462135084Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0297","title":"Updated librsvg packages fix a security vulnerability","description":"Updated librsvg package fixes security vulnerability:\n\nIt was discovered that there was an input validation vulnerability in the \nlibrsvg renderer library that could result in data being leaked to remote \nattackers via a specially-crafted file (CVE-2018-1000041).\n","status":"published","published":"2018-06-24T22:02:29Z","modified":"2026-04-16T06:24:46.438975307Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2018:1288-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issues:\n\n- CVE-2018-1000041: Input validation issue could lead to credentials leak. (bsc#1083232)\n\nUpdate to version 2.40.20:\n\n  + Except for emergencies, this will be the LAST RELEASE of the\n    librsvg-2.40.x series.  We are moving to 2.41, which is vastly\n    improved over the 2.40 series.  The API/ABI there remain unchaged,\n    so we strongly encourage you to upgrade your sources and binaries to\n    librsvg-2.41.x.\n  + bgo#761175 - Allow masks and clips to reuse a node being drawn.\n  + Don't access the file system when deciding whether to load a remote\n    file with a UNC path for a paint server (i.e. don't try to load it at all).\n  + Vistual Studio: fixed and integrated introspection builds, so\n    introspection data is built directly from the Visual Studio project\n    (Chun-wei Fan).\n  + Visual Studio: We now use HIGHENTROPYVA linker option on x64 builds,\n    to enhance the security of built binaries (Chun-wei Fan).\n  + Fix generation of Vala bindings when compiling in read-only source\n    directories (Emmanuele Bassi).\n\nUpdate to version 2.40.19:\n\n  + bgo#621088: Using text objects as clipping paths is now supported.\n  + bgo#587721: Fix rendering of text elements with transformations (Massimo).\n  + bgo#777833 - Fix memory leaks when an RsvgHandle is disposed before\n    being closed (Philip Withnall).\n  + bgo#782098 - Don't pass deprecated options to gtk-doc (Ting-Wei Lan).\n  + bgo#786372 - Fix the default for the 'type' attribute of the \u003cstyle\u003e element.\n  + bgo#785276 - Don't crash on single-byte files.\n  + bgo#634514: Don't render unknown elements and their sub-elements.\n  + bgo#777155 - Ignore patterns that have close-to-zero dimensions.\n  + bgo#634324 - Fix Gaussian blurs with negative scaling.\n  + Fix the \u003cswitch\u003e element; it wasn't working at all.\n  + Fix loading when rsvg_handle_write() is called one byte at a time.\n  + bgo#787895 - Fix incorrect usage of libxml2.  Thanks to Nick Wellnhofer\n    for advice on this.\n  + Backported the test suite machinery from the master branch (Chun-wei Fan,\n    Federico Mena).\n  + We now require Pango 1.38.0 or later (released in 2015).\n  + We now require libxml2 2.9.0 or later (released in 2012).\n","status":"published","published":"2018-05-15T13:04:44Z","modified":"2026-02-04T02:56:57.020087Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}