{"id":"CVE-2019-20446","aliases":["ALPINE-CVE-2019-20446","ALSA-2020:4709","DEBIAN-CVE-2019-20446","DLA-2285-1","EUVD-2019-10992","GHSA-whvx-2m69-j66g","JLSEC-2026-511","MGASA-2020-0159","RHSA-2020:4709","RLSA-2020:4709","SUSE-SU-2020:0604-1","SUSE-SU-2020:0629-1","SUSE-SU-2020:0629-2","UBUNTU-CVE-2019-20446","USN-4436-1","openSUSE-SU-2020:0343-1","openSUSE-SU-2024:10986-1"],"status":"published","title":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause...","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02125,"percentile":0.82039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-02-02T00:00:00Z","modified":"2026-11-03T06:31:56Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"librsvg","fixed_in":["2.40.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"librsvg","fixed_in":["2.46.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"librsvg","fixed_in":["2.40.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"librsvg","fixed_in":["2.40.21-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"librsvg2","fixed_in":["2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"librsvg2-devel","fixed_in":["2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"librsvg2-tools","fixed_in":["2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"librsvg","fixed_in":["2.46.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librsvg","fixed_in":["2.46.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librsvg","fixed_in":["2.46.4-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Librsvg_jll","fixed_in":["2.52.4+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"librsvg","fixed_in":["2.45.5-3.1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-debuginfo","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-debugsource","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-devel","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-tools","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-tools-debuginfo","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"librsvg2","fixed_in":["0:2.42.7-4.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"librsvg","fixed_in":["2.40.21-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"librsvg","fixed_in":["2.40.21-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"librsvg","fixed_in":["2.40.21-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"librsvg","fixed_in":["2.40.21-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"librsvg","fixed_in":["2.40.21-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"librsvg","fixed_in":["2.40.21-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"librsvg","fixed_in":["2.42.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"librsvg","fixed_in":["2.42.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"librsvg","fixed_in":["2.42.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"librsvg","fixed_in":["2.42.8-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"librsvg","fixed_in":["2.42.8-lp151.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.40.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.46.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.40.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.42.0"},{"fixed":"2.40.21-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"librsvg2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-0+deb9u1"}]}],"versions":["2.40.16-1","2.40.16-2","2.40.18-1","2.40.18-2","2.40.18-3","2.40.20-1","2.40.20-2","2.40.20-3","2.40.20-3+0.riscv64.1","2.40.20-3+ports","2.40.20-3.0","2.40.20-3.0~hurd.2"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"Librsvg_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.52.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.5-3.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librsvg2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"librsvg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.7-4.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.21-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40.10-1","2.40.11-1","2.40.11-2","2.40.12-1","2.40.13-1","2.40.13-2","2.40.13-3","2.40.13-3ubuntu0.1","2.40.13-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40.18-1","2.40.18-2","2.40.20-2","2.40.20-2ubuntu0.1","2.40.20-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.13-3ubuntu0.1"}]}],"versions":["2.40.10-1","2.40.11-1","2.40.11-2","2.40.12-1","2.40.13-1","2.40.13-2","2.40.13-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.20-2ubuntu0.1"}]}],"versions":["2.40.18-1","2.40.18-2","2.40.20-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-lp151.3.3.1"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"librsvg"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/librsvg/issues/515","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00024.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4436-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20221111-0004/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20446","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/"},{"url":"https://github.com/advisories/GHSA-whvx-2m69-j66g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-20446","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-4709.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-20446","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20446","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0159.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26313","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2020-March/006583.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2020-03/msg00080.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4709","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1797608","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4709.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20446","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20446","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4709","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1162501","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20446","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200629-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200629-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20446","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4436-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4436-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-11464","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3CV6E2IAKNCNDVO5MXFKSTGO3PMWDL65/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11464","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-20446","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T00:00:00Z","modified":"2024-08-05T02:39:09.924Z","updated_at":"2026-11-02T14:20:17.11067Z"}],"euvd":[{"id":"EUVD-2019-10992","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T00:00:00Z","modified":"2024-08-05T02:39:09Z","updated_at":"2026-11-03T02:40:22.238276Z"}],"ghsa":[{"id":"GHSA-whvx-2m69-j66g","title":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause...","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2022-05-24T17:07:51Z","modified":"2023-02-02T05:08:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:52:41.978099Z"}],"nvd":[{"id":"CVE-2019-20446","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T14:15:10.523Z","modified":"2026-06-17T02:30:28.273Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"ALPINE-CVE-2019-20446","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T14:15:10.523Z","modified":"2026-11-03T06:31:56.658740763Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-20446","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T14:15:10.523Z","modified":"2026-10-24T10:50:35.408570611Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20446","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T14:15:10.523Z","modified":"2026-09-21T07:03:17.829340287Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"JLSEC-2026-511","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2026-05-19T01:34:38.069Z","modified":"2026-07-18T00:00:39.033114654Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2020:4709","title":"Red Hat Security Advisory: librsvg2 security update","status":"published","published":"2024-09-16T04:15:49Z","modified":"2026-01-14T11:02:55.907444Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4709","title":"Moderate: librsvg2 security update","description":"The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.\n\nSecurity Fix(es):\n\n* librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:29:09Z","modified":"2026-02-05T00:00:05.212934Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-20446","description":"In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.","status":"published","published":"2020-02-02T14:15:00Z","modified":"2026-04-22T12:17:14.322238Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"ALSA-2020:4709","title":"Moderate: librsvg2 security update","description":"The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.\n\nSecurity Fix(es):\n\n* librsvg: Resource exhaustion via crafted SVG file with nested patterns (CVE-2019-20446)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:29:09Z","modified":"2026-10-29T11:00:17.17886255Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2285-1","title":"librsvg - security update","status":"published","published":"2020-07-22T00:00:00Z","modified":"2026-03-09T01:19:53.288319Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0159","title":"Updated librsvg packages fix security vulnerability","description":"The updated packages fix a security vulnerability:\n\nIn xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested\npatterns can cause denial of service when passed to the library for\nprocessing. The attacker constructs pattern elements so that the number\nof final rendered objects grows exponentially. (CVE-2019-20446)\n","status":"published","published":"2020-04-05T17:07:15Z","modified":"2026-04-16T04:41:16.582530045Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0343-1","title":"Security update for librsvg","description":"This update for librsvg to version 2.42.8 fixes the following issues:\n\nlibrsvg was updated to version 2.42.8 fixing the following issues:\t  \n\n- CVE-2019-20446: Fixed an issue where a crafted SVG file with nested\n  patterns can cause denial of service (bsc#1162501).\n  NOTE: Librsvg now has limits on the number of loaded XML elements,\n  and the number of referenced elements within an SVG document. \n- Fixed a stack exhaustion with circular references in \u003cuse\u003e\n  elements.\n- Fixed a denial-of-service condition from exponential explosion\n  of rendered elements, through nested use of SVG 'use' elements in\n  malicious SVGs.  \n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-03-15T17:11:46Z","modified":"2026-02-04T02:57:48.263773Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10986-1","title":"gdk-pixbuf-loader-rsvg-2.50.7-1.5 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.50.7-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:38.801309Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:0604-1","title":"Security update for librsvg","description":"This update for librsvg to version 2.40.21 fixes the following issues:\n\nlibrsvg was updated to version 2.40.21 fixing the following issues:\t  \n\n- CVE-2019-20446: Fixed an issue where a crafted SVG file with nested\n  patterns can cause denial of service (bsc#1162501).\n  NOTE: Librsvg now has limits on the number of loaded XML elements,\n  and the number of referenced elements within an SVG document. \n- Fixed a stack exhaustion with circular references in \u003cuse\u003e\n  elements.\n- Fixed a denial-of-service condition from exponential explosion\n  of rendered elements, through nested use of SVG 'use' elements in\n  malicious SVGs.  \n","status":"published","published":"2020-03-06T10:07:41Z","modified":"2026-02-04T02:36:32.483213Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0629-1","title":"Security update for librsvg","description":"This update for librsvg to version 2.42.8 fixes the following issues:\n\nlibrsvg was updated to version 2.42.8 fixing the following issues:\t  \n\n- CVE-2019-20446: Fixed an issue where a crafted SVG file with nested\n  patterns can cause denial of service (bsc#1162501).\n  NOTE: Librsvg now has limits on the number of loaded XML elements,\n  and the number of referenced elements within an SVG document. \n- Fixed a stack exhaustion with circular references in \u003cuse\u003e\n  elements.\n- Fixed a denial-of-service condition from exponential explosion\n  of rendered elements, through nested use of SVG 'use' elements in\n  malicious SVGs.  \n","status":"published","published":"2020-07-07T11:45:14Z","modified":"2026-02-04T03:46:35.304397Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0629-2","title":"Security update for librsvg","description":"This update for librsvg to version 2.42.8 fixes the following issues:\n\nlibrsvg was updated to version 2.42.8 fixing the following issues:\t  \n\n- CVE-2019-20446: Fixed an issue where a crafted SVG file with nested\n  patterns can cause denial of service (bsc#1162501).\n  NOTE: Librsvg now has limits on the number of loaded XML elements,\n  and the number of referenced elements within an SVG document. \n- Fixed a stack exhaustion with circular references in \u003cuse\u003e\n  elements.\n- Fixed a denial-of-service condition from exponential explosion\n  of rendered elements, through nested use of SVG 'use' elements in\n  malicious SVGs.  \n","status":"published","published":"2020-07-07T11:45:30Z","modified":"2025-05-02T04:09:10.646633Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4436-1","title":"librsvg vulnerabilities","description":"It was discovered that librsvg incorrectly handled parsing certain SVG\nfiles. A remote attacker could possibly use this issue to cause librsvg to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n16.04 LTS. (CVE-2017-11464)\n\nIt was discovered that librsvg incorrectly handled parsing certain SVG\nfiles with nested patterns. A remote attacker could possibly use this issue\nto cause librsvg to consume resources and crash, resulting in a denial of\nservice. (CVE-2019-20446)\n","status":"published","published":"2020-07-27T14:15:53Z","modified":"2026-04-22T10:06:26.379001Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}