Ubuntu Security Notice 2149-1 - It was discovered that librsvg would load XML external entities by default. If a user were tricked into viewing a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files.
543f622bfe3bb7fe528fc224f4699359de9f4893eb9828f3de40efa064f6ece8
============================================================================
Ubuntu Security Notice USN-2149-1
March 17, 2014
librsvg vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
Summary:
Librsvg could be made to expose sensitive information.
Software Description:
- librsvg: renderer library for SVG files
Details:
It was discovered that librsvg would load XML external entities by default.
If a user were tricked into viewing a specially crafted SVG file, an
attacker could possibly obtain access to arbitrary files.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
librsvg2-2 2.36.4-2ubuntu0.1
Ubuntu 12.10:
librsvg2-2 2.36.3-0ubuntu1.1
Ubuntu 12.04 LTS:
librsvg2-2 2.36.1-0ubuntu1.1
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2149-1
CVE-2013-1881
Package Information:
https://launchpad.net/ubuntu/+source/librsvg/2.36.4-2ubuntu0.1
https://launchpad.net/ubuntu/+source/librsvg/2.36.3-0ubuntu1.1
https://launchpad.net/ubuntu/+source/librsvg/2.36.1-0ubuntu1.1