{"id":"MGASA-2015-0100","aliases":[],"status":"published","title":"Updated librsvg packages fix security vulnerabilities","description":"Atte Kettunen's fuzz testing found several vulnerabilities in librsvg:\n- Invalid memory access caused by incorrect handling of a pattern paint\n  server with an xlink:href to a unexpected type (bgo#744299)\n- Infinite loop in the handling of gradients (bgo#738169)\n- Heap-buffer-overflow when there's a missing point in a point-list\n  (bgo#738050)\n- Out of bounds memory access when clipping (bgo#703102)\n- Integer overflow in the convolution matrix filter code (commit 53c50c)\n- Fix double g_free() when processing stroke-dasharray (bgo#744688)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-03-08T20:47:43Z","modified":"2026-04-16T04:28:40Z","fixes":[{"ecosystem":"Mageia:4","package":"librsvg","fixed_in":["2.39.0-1.2.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:4","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.0-1.2.mga4"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2015-0100.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15303","tags":["report"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=744299","tags":["report"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=738169","tags":["report"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=738050","tags":["report"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=703102","tags":["report"]},{"url":"https://git.gnome.org/browse/librsvg/commit/?id=53c50caecc970aef91cf8e3f1fde919f848d6f0c","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2015-0100","title":"Updated librsvg packages fix security vulnerabilities","description":"Atte Kettunen's fuzz testing found several vulnerabilities in librsvg:\n- Invalid memory access caused by incorrect handling of a pattern paint\n  server with an xlink:href to a unexpected type (bgo#744299)\n- Infinite loop in the handling of gradients (bgo#738169)\n- Heap-buffer-overflow when there's a missing point in a point-list\n  (bgo#738050)\n- Out of bounds memory access when clipping (bgo#703102)\n- Integer overflow in the convolution matrix filter code (commit 53c50c)\n- Fix double g_free() when processing stroke-dasharray (bgo#744688)\n","status":"published","published":"2015-03-08T20:47:43Z","modified":"2026-04-16T04:28:40.997098Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}