librsvg: CVE-2013-1881

Debian Bug report logs - #724741
librsvg: CVE-2013-1881

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: librsvg: CVE-2013-1881

Date: Fri, 27 Sep 2013 13:48:05 +0200

Package: librsvg
Severity: important
Tags: security
Justification: user security hole

Please see
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1881
https://bugzilla.gnome.org/show_bug.cgi?id=691708

I don't think this warrants a DSA, if it gets fixed up in a point update
we need to make sure that GTK is fixed as well, see
https://bugzilla.redhat.com/show_bug.cgi?id=924414#c7

Cheers,
        Moritz

Message #10 received at 724741-close@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: 724741-close@bugs.debian.org

Subject: Bug#724741: fixed in librsvg 2.40.0-1

Date: Mon, 21 Oct 2013 12:18:24 +0000

Source: librsvg
Source-Version: 2.40.0-1

We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 724741@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Biebl <biebl@debian.org> (supplier of updated librsvg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 21 Oct 2013 13:58:34 +0200
Source: librsvg
Binary: librsvg2-dev librsvg2-2 librsvg2-common librsvg2-doc librsvg2-dbg librsvg2-bin gir1.2-rsvg-2.0
Architecture: source all amd64
Version: 2.40.0-1
Distribution: unstable
Urgency: low
Maintainer: Josselin Mouette <joss@debian.org>
Changed-By: Michael Biebl <biebl@debian.org>
Description: 
 gir1.2-rsvg-2.0 - gir files for renderer library for SVG files
 librsvg2-2 - SAX-based renderer library for SVG files (runtime)
 librsvg2-bin - command-line and graphical viewers for SVG files
 librsvg2-common - SAX-based renderer library for SVG files (extra runtime)
 librsvg2-dbg - SAX-based renderer library for SVG files (debug)
 librsvg2-dev - SAX-based renderer library for SVG files (development)
 librsvg2-doc - SAX-based renderer library for SVG files (documentation)
Closes: 724741
Changes: 
 librsvg (2.40.0-1) unstable; urgency=low
 .
   [ Michael Biebl ]
   * New upstream release.
     - Fixes local resource access vulnerability. Closes: #724741
       CVE-2013-1881
   * Refresh patches.
   * GTK2 support has been removed upstream. Drop Build-Depends on
     libgtk2.0-dev, libgtk2.0-doc and the now obsolete --disable-gtk-theme
     configure switch.
   * Bump Build-Depends on libgtk-3-dev to (>= 3.2.0).
   * Bump Build-Depends on libpango1.0-dev to (>= 1.36.0) to get the
     thread-safe version.
 .
   [ Laurent Bigonville ]
   * debian/control.in:
     - Use canonical URL for VCS-* fields
     - Update Homepage URL
     - Move source package to the "libs" Section
     - Remove duplicate Section, thanks to lintian
Checksums-Sha1: 
 816272e349526463e982137a2969425880e5e9ee 2720 librsvg_2.40.0-1.dsc
 eb915c9d963326e74be2e92fba4c4e9fbb06eefe 505300 librsvg_2.40.0.orig.tar.xz
 5c802beb74f35ea5c43cfb629377c52c52c0921a 15432 librsvg_2.40.0-1.debian.tar.gz
 18e96ff611e877d5ae9352a1ed586c773cac1bf8 183302 librsvg2-doc_2.40.0-1_all.deb
 d4ad4b3f2b6e2951032e1467168e25094b2fd868 260246 librsvg2-dev_2.40.0-1_amd64.deb
 3de87ab6a62e176102d37b65854ccf19a412dd43 243454 librsvg2-2_2.40.0-1_amd64.deb
 4d6bf2407846839fd7ddf5cd8dfaf57fa9ac54ac 167576 librsvg2-common_2.40.0-1_amd64.deb
 a6cd3e27f09a63355659e01a300f92868d92c324 445452 librsvg2-dbg_2.40.0-1_amd64.deb
 94281d86c24f0c6ab477446b81861064f5d9f07f 177944 librsvg2-bin_2.40.0-1_amd64.deb
 960c918520916bbb5b473c0768331107b54ab249 166160 gir1.2-rsvg-2.0_2.40.0-1_amd64.deb
Checksums-Sha256: 
 c461b33d3dac5cf7c637c1979e3f1483519dfa2e4fb5d6cd8b412163d896b7d0 2720 librsvg_2.40.0-1.dsc
 8f7db31df235813dbd035888035cf862d682e7cc5706c4e7ec05750d3f64a2f9 505300 librsvg_2.40.0.orig.tar.xz
 43920c390c6161180f390a5167037db67ba06795b8fd6bea3408a4575a220890 15432 librsvg_2.40.0-1.debian.tar.gz
 f8eb65fb6d27b36f4509f36a4d7da9268db3221f8b9617ede8454a59dd30b277 183302 librsvg2-doc_2.40.0-1_all.deb
 431b74022c0135a1a9067b224090efa699d4266a0b4cedb8639e1e221a2260d8 260246 librsvg2-dev_2.40.0-1_amd64.deb
 689fb1dd84949309c0ddc9100cecad66d54136c6380c1108fa8b88bc88a3b9f2 243454 librsvg2-2_2.40.0-1_amd64.deb
 a8f2e12dc953d0cf3f5d4001e79544c015b6e5fa21fe7548f600d7ee75d204fa 167576 librsvg2-common_2.40.0-1_amd64.deb
 b31aba13ae4491136d92ec0f1f1dcf5e5f201258c498a68e4270a050e41bcb89 445452 librsvg2-dbg_2.40.0-1_amd64.deb
 bef923f15979474ce3388205b36678cf253e3c303ab695bba9ea6c1fe91537c0 177944 librsvg2-bin_2.40.0-1_amd64.deb
 f20cd10c31dfbf490fc86425914f0082b1c664719e3af4161bf234f92e746203 166160 gir1.2-rsvg-2.0_2.40.0-1_amd64.deb
Files: 
 bde66e2522df64d0dc92daec893cec02 2720 libs optional librsvg_2.40.0-1.dsc
 e16a84e9a86a18e5ca6ba95c512db6c6 505300 libs optional librsvg_2.40.0.orig.tar.xz
 3fbb03fb861325aee41f7dfbdbefe0fd 15432 libs optional librsvg_2.40.0-1.debian.tar.gz
 1e86577a7f938e684d7e20c15ada0cb1 183302 doc optional librsvg2-doc_2.40.0-1_all.deb
 1761ef1b00853b2dedb3fa3d96a6a320 260246 libdevel optional librsvg2-dev_2.40.0-1_amd64.deb
 5cdcab978f4479d3c1bdd0de30f48329 243454 libs optional librsvg2-2_2.40.0-1_amd64.deb
 54c4867d7704f1e0fe13676f4c78e2eb 167576 libs optional librsvg2-common_2.40.0-1_amd64.deb
 d8f7a668fb5be6e317c38d0c92c9d9d2 445452 debug extra librsvg2-dbg_2.40.0-1_amd64.deb
 8eb471e9b78f42f6095d03bd3e4e9d02 177944 graphics optional librsvg2-bin_2.40.0-1_amd64.deb
 62b634a760509725363a38bda0d98554 166160 introspection optional gir1.2-rsvg-2.0_2.40.0-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBCAAGBQJSZRdlAAoJEGrh4w1gjyLc1YYQAJbgdWgk3Y3qnHjjoI3YW/Hc
aH5/FHnGvuHl+bmxUySCKH0O36PlESpZsS4g3dKB9sX8O+VsE5gbl/+dc72b/iBU
3AuPFvf8+a6k2QlrmmF2lAn1rrGiqs7hwNTC077uIfpR0y2iFQtZRuGCW7VRQabq
bJ0RYH1cpsGX3L2rj1Rzx+nVjerfanqURuzgvHrNqXBz1vt5BMpYsnZ2Z2xetmLM
k7WYkKTCdANrYyX/zLxedYngMwR/d+/ln10eCTXLVwGNyHwo23Hdy59CS+fs3nuc
EMVO6l4r9viZg4ETghrJa3Q9SYx9VQD8L04189mU2TI7VGCs+UK5pcpgMUSs4XBF
VBYqaFtbkYu4VhNxzzWqTiB7qVibmu+08lGr2bGPaGjziU7GRxt4npgz6j7IuGuw
XMAiOASI1XAA2T7pdgvyQVGZLUZxWzu9fE2QvELaBtfnUsm+GkPq5aPLp95NR7rT
TElgB8jcfEa2l5EgyEwMfAziBFyzotKotmTORfkmisRd0BwD01GwEMXUL3bVG0ri
rTeraoAcztEKRE98vObf4oH3Y3WM46w+CBHclSsUOWfST+lf4NjkdLldxLVSPWnD
XmH9ZP3HPQLMTIt4bnlpBuX0Cp6Oxrsq18UE7XDCSlfONCDHtAj5OVSSYeC+6EIZ
rNCPt0PggBeRX/QpE9ps
=71dr
-----END PGP SIGNATURE-----

Message #15 received at 724741@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: 724741@bugs.debian.org

Subject: Re: Bug#724741: librsvg: CVE-2013-1881

Date: Thu, 28 Nov 2013 14:29:16 +0100

[Message part 1 (text/plain, inline)]

Control: tag -1 patch

Hi,

Attached CVE-2013-1881* patches apply to librsvg in squeeze, with only
a partial origin policy (it ignores the location in the local fs).
Upstream's librsvg patches apply clean to the version in wheezy,
except that the gtk+3.0 patch needs some tweaks;
use_data_uris_for_symbolic_icons.patch does the same for the version
in wheezy.

Could you please prepare packages for O/SPU and coordinate with the
release team?

TIA.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

[CVE-2013-1881.policy.patch (text/x-patch, attachment)]

[CVE-2013-1881.xmlentities.patch (text/x-patch, attachment)]

[use_data_uris_for_symbolic_icons.patch (text/x-patch, attachment)]

Message #24 received at 724741-close@bugs.debian.org (full text, mbox, reply):

From: Josselin Mouette <joss@debian.org>

To: 724741-close@bugs.debian.org

Subject: Bug#724741: fixed in librsvg 2.36.1-2

Date: Thu, 05 Dec 2013 21:17:10 +0000

Source: librsvg
Source-Version: 2.36.1-2

We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 724741@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Josselin Mouette <joss@debian.org> (supplier of updated librsvg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 04 Dec 2013 21:08:25 +0100
Source: librsvg
Binary: librsvg2-dev librsvg2-2 librsvg2-common librsvg2-doc librsvg2-dbg librsvg2-bin gir1.2-rsvg-2.0
Architecture: source all amd64
Version: 2.36.1-2
Distribution: stable
Urgency: low
Maintainer: Josselin Mouette <joss@debian.org>
Changed-By: Josselin Mouette <joss@debian.org>
Description: 
 gir1.2-rsvg-2.0 - gir files for renderer library for SVG files
 librsvg2-2 - SAX-based renderer library for SVG files (runtime)
 librsvg2-bin - command-line and graphical viewers for SVG files
 librsvg2-common - SAX-based renderer library for SVG files (extra runtime)
 librsvg2-dbg - SAX-based renderer library for SVG files (debug)
 librsvg2-dev - SAX-based renderer library for SVG files (development)
 librsvg2-doc - SAX-based renderer library for SVG files (documentation)
Closes: 724741
Changes: 
 librsvg (2.36.1-2) stable; urgency=low
 .
   [ Raphaël Geissert ]
   * Fix CVE-2013-1881: disable loading of external entities.
     Closes: #724741.
 .
   [ Josselin Mouette ]
   * Break libgtk-3-0 (<< 3.4.2-7) which uses the anti-feature that is
     disabled by the security fix.
Checksums-Sha1: 
 0096d409942fd041fbd144abab555723f16d54b5 2117 librsvg_2.36.1-2.dsc
 dc9435c3095594022926d718013a947b6e3f2643 18629 librsvg_2.36.1-2.debian.tar.gz
 e0ff0962a7836b83c35d13266f05579c94c7a4b6 177710 librsvg2-doc_2.36.1-2_all.deb
 b44c7aa4c8fdd1d44ca725f9d178fc0ce9075bba 253560 librsvg2-dev_2.36.1-2_amd64.deb
 e7cd556fa3c0b2cde4e2d2efa14290baac894269 238820 librsvg2-2_2.36.1-2_amd64.deb
 708f908a53a1c12ed571ca60affd80c715eb4ef1 161908 librsvg2-common_2.36.1-2_amd64.deb
 be67cbcc5a599c9c2bf6ec64dd954e1f217d8f73 451770 librsvg2-dbg_2.36.1-2_amd64.deb
 293f0279646c892c1d9ba51329aee2b7d9879939 172906 librsvg2-bin_2.36.1-2_amd64.deb
 d507f2938c909d657675bbb6d2796ce0c7de163c 160298 gir1.2-rsvg-2.0_2.36.1-2_amd64.deb
Checksums-Sha256: 
 4e183f61487a932f9295da0c058dab75113d66c203722413962043bc9d5b9bcb 2117 librsvg_2.36.1-2.dsc
 de500c9ca48429ae49695d1c8c393bb874a113cb5d8908b0c0ff2200d943c029 18629 librsvg_2.36.1-2.debian.tar.gz
 84dfe4c5cff07c56ebb5b2f616199c61315ae2ce4b0ed8afada7fcb6650086e0 177710 librsvg2-doc_2.36.1-2_all.deb
 a5a7c3ae8a36a6dd110c92898cfe21cd78dbe9a0f9db45a853c51847f12e39de 253560 librsvg2-dev_2.36.1-2_amd64.deb
 047f8e2bf70072b0d7e2e51791fcfc10bbc74cc103c41f993739017c1b07528d 238820 librsvg2-2_2.36.1-2_amd64.deb
 715cd76afbb0a1fd94d42249e7148ff0f1da7bc3cb27522e8ccaf0f8a64e29e8 161908 librsvg2-common_2.36.1-2_amd64.deb
 a4799e7f265e17fa83f04329fd571008b9a34ff2dd4f27b0f69d888d6cb30701 451770 librsvg2-dbg_2.36.1-2_amd64.deb
 ddea058f2ee38b306d69497abd4d7fc2a74365047510a3cdcdfd4d6c553f5f1b 172906 librsvg2-bin_2.36.1-2_amd64.deb
 cded9e204794829d159ef99c269de660cf90c40fc4dd2e53eb10d7b8aa552377 160298 gir1.2-rsvg-2.0_2.36.1-2_amd64.deb
Files: 
 2a1519b365c1a8d512edf8f047902d33 2117 libdevel optional librsvg_2.36.1-2.dsc
 acc062fbfda551fa0c2e57b0e0a3ae57 18629 libdevel optional librsvg_2.36.1-2.debian.tar.gz
 65c07c553f38e42659e1263589a4ce51 177710 doc optional librsvg2-doc_2.36.1-2_all.deb
 855cfde96b488e0279f6aa611f557e06 253560 libdevel optional librsvg2-dev_2.36.1-2_amd64.deb
 95ccada5f6de10d8decd90ab61dbcba6 238820 libs optional librsvg2-2_2.36.1-2_amd64.deb
 b56e8742c9002d1f6aca3288662bb896 161908 libs optional librsvg2-common_2.36.1-2_amd64.deb
 77263bb8579252903f82e2142e495c64 451770 debug extra librsvg2-dbg_2.36.1-2_amd64.deb
 39a5e90ebfa236c8fa7603fb12a524f9 172906 graphics optional librsvg2-bin_2.36.1-2_amd64.deb
 ae55fc3304552282371f300fe2473b61 160298 introspection optional gir1.2-rsvg-2.0_2.36.1-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlKfr1IACgkQrSla4ddfhTOuagCcCaZyVRHwGGn6+vgylCMO0NeY
z4oAoND6Mwj4iVQ9KexDNuE3YEu6qSWv
=LxgB
-----END PGP SIGNATURE-----

Message #29 received at 724741-close@bugs.debian.org (full text, mbox, reply):

From: Josselin Mouette <joss@debian.org>

To: 724741-close@bugs.debian.org

Subject: Bug#724741: fixed in librsvg 2.26.3-1+deb6u1

Date: Thu, 05 Dec 2013 22:17:38 +0000

Source: librsvg
Source-Version: 2.26.3-1+deb6u1

We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 724741@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Josselin Mouette <joss@debian.org> (supplier of updated librsvg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 04 Dec 2013 15:35:15 +0100
Source: librsvg
Binary: librsvg2-dev librsvg2-2 librsvg2-common librsvg2-dbg librsvg2-bin
Architecture: source amd64
Version: 2.26.3-1+deb6u1
Distribution: oldstable
Urgency: low
Maintainer: Josselin Mouette <joss@debian.org>
Changed-By: Josselin Mouette <joss@debian.org>
Description: 
 librsvg2-2 - SAX-based renderer library for SVG files (runtime)
 librsvg2-bin - command-line and graphical viewers for SVG files
 librsvg2-common - SAX-based renderer library for SVG files (extra runtime)
 librsvg2-dbg - SAX-based renderer library for SVG files (debug)
 librsvg2-dev - SAX-based renderer library for SVG files (development)
Closes: 724741
Changes: 
 librsvg (2.26.3-1+deb6u1) oldstable; urgency=low
 .
   [ Raphaël Geissert ]
   * Fix CVE-2013-1881: disable loading of external entities.
     Closes: #724741.
Checksums-Sha1: 
 6a510ba7fb4f0fd2b3f6d41be9f89dcad7b7a060 1709 librsvg_2.26.3-1+deb6u1.dsc
 2e4b15c0cb313ae3fc99fc801608fcd1a9342fc4 12585 librsvg_2.26.3-1+deb6u1.diff.gz
 8c84c7b9db5df4e4ac2196a68ae6346ac28316bf 192434 librsvg2-dev_2.26.3-1+deb6u1_amd64.deb
 1871757261a92847e720b8805aa1d3dcb36e2bfb 149262 librsvg2-2_2.26.3-1+deb6u1_amd64.deb
 8da637f9bb9706fac5e9281d7fa2ea72de8992b3 70350 librsvg2-common_2.26.3-1+deb6u1_amd64.deb
 8a60c2a44fe4ce6c1cb9e24f2a81dc892c142e97 410370 librsvg2-dbg_2.26.3-1+deb6u1_amd64.deb
 96211bcae859bf135d5b09e140d62865d8e2beea 72706 librsvg2-bin_2.26.3-1+deb6u1_amd64.deb
Checksums-Sha256: 
 ad9882e674f3860d0212c6e47d5a85e2f9b9605e95488879f86264372e5e31b2 1709 librsvg_2.26.3-1+deb6u1.dsc
 f8508f50586573e0cd453483453a3fd2e9fdc5b4c2460fccf5b48a2c31adfde8 12585 librsvg_2.26.3-1+deb6u1.diff.gz
 6ffb48da1714e64104dcae59d7d8eb156c7d373f22388e8d0f2b7fa1d00a3831 192434 librsvg2-dev_2.26.3-1+deb6u1_amd64.deb
 d001ca203be762f77508a6a3836fde96db1603782899676a0c4719a03cfd808a 149262 librsvg2-2_2.26.3-1+deb6u1_amd64.deb
 29374c9dcf1629c21c676b4afaf04f5644b94836f8daf36af90f95ac59e36247 70350 librsvg2-common_2.26.3-1+deb6u1_amd64.deb
 11b0fc63144e38a5d434730909b8e886f8bef8f38e824fb8575b12502f4c7c77 410370 librsvg2-dbg_2.26.3-1+deb6u1_amd64.deb
 dc2343636ab77322a8e5251ae1def94ea30c7d97f9736a158aca68cafbb1de71 72706 librsvg2-bin_2.26.3-1+deb6u1_amd64.deb
Files: 
 ee4121e2116223e9c2fee44dc91ca8c1 1709 libdevel optional librsvg_2.26.3-1+deb6u1.dsc
 ad864fa315cdbebfe1e6a00a4bd3e9b2 12585 libdevel optional librsvg_2.26.3-1+deb6u1.diff.gz
 4c6a523430d7cd7886908c063959ab94 192434 libdevel optional librsvg2-dev_2.26.3-1+deb6u1_amd64.deb
 5d0ffe64fe4862c093d3b54ed710b9d3 149262 libs optional librsvg2-2_2.26.3-1+deb6u1_amd64.deb
 9caa743b708dc9e9c104a3e8c88fa9c5 70350 libs optional librsvg2-common_2.26.3-1+deb6u1_amd64.deb
 64e1c87b211f56617c462a85b71833ec 410370 debug extra librsvg2-dbg_2.26.3-1+deb6u1_amd64.deb
 452b37363fb399fd115583658ea8aa1f 72706 graphics optional librsvg2-bin_2.26.3-1+deb6u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlKfs80ACgkQrSla4ddfhTMm4gCfcoFtCtHQE8aqbGi1JKqDAndJ
xS0AoL0Mfw5dlhkvyT1OKRwx05vblU/g
=j/mJ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.