Preisgabe von Informationen in libRSVG
ID: | USN-2149-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 12.04 LTS, Ubuntu 12.10, Ubuntu 13.10 |
Datum: | Mo, 17. März 2014, 13:49 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1881 |
Applikationen: | libRSVG |
Originalnachricht |
|
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============5902562234248317447== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="83whgu5FDxMw6VeJQDg4v1h7T6ahWxfNX" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --83whgu5FDxMw6VeJQDg4v1h7T6ahWxfNX Content-Type: text/plain; charset=UTF- Content-Transfer-Encoding: quoted-printable ========================================================================== Ubuntu Security Notice USN-2149-1 March 17, 2014 librsvg vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Librsvg could be made to expose sensitive information. Software Description: - librsvg: renderer library for SVG files Details: It was discovered that librsvg would load XML external entities by default. If a user were tricked into viewing a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: librsvg2-2 2.36.4-2ubuntu0.1 Ubuntu 12.10: librsvg2-2 2.36.3-0ubuntu1.1 Ubuntu 12.04 LTS: librsvg2-2 2.36.1-0ubuntu1.1 After a standard system update you need to restart your session to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2149-1 CVE-2013-1881 Package Information: https://launchpad.net/ubuntu/+source/librsvg/2.36.4-2ubuntu0.1 https://launchpad.net/ubuntu/+source/librsvg/2.36.3-0ubuntu1.1 https://launchpad.net/ubuntu/+source/librsvg/2.36.1-0ubuntu1.1 --83whgu5FDxMw6VeJQDg4v1h7T6ahWxfNX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCgAGBQJTJuX0AAoJEGVp2FWnRL6TteAP/3rYaPmrYh6muL2xhzEMLsBg nREpqdS8K0L58G19DSO6eSVtBnX2hd3RHykkJvA/U94cQUG3FKQ+sDondhEwTxXL IGY4GyFw07bkyMVk7cM/FqKKQUPrgDsASfj/1UK+he8E9BYk8hTtbALaSsIFtRBE 7OejOAdTZZY1eU+xbI6cWcadh41c9GJYF2pLmDxpr//Svf87lqEFBYopSsbTAVki LyAQmyub8lC64SIyxpt5FlrCXFSYpXWpJK6JnzuI1bYv+FK8ZVZII52G4+urWj1Z 7gD+KSfSq0RL67X5Qsbjv+1pz3m31xPebYAdpoB/xo9prOmUcZNU8uzFdKeTfwDJ MaWvcVtoiwBVTpYzWF5v7RgYGFvh/k/+zF5gcRX2GnZ5c5Wr527FxBd3Nlx0xUeS NDXdjm4d9Whkox7WW8oJAfyfx6C10c8i1vK4/Ku1YvgMlqiZvcyTa02aTjalpDz8 a1OkPNyZ9w/zsTA28PWe4wQFTCXkHuxpAurbx32iFELiJvLx78mgL4qP6YaMLSX8 qY9r2wHk5PUO7L3lt+pF+F4uXJ+ydhx9YhInEDgLyI5DFxxnEc+BZeqeopIvSOXM P0nCLyJ5qYs3NabUr35zNF+ehIYFNS3+lg8S+kDzE3fNTEXzdMIei+1JQ9gGiyor CNdv83QA+0+po3E/m2vK =+8nd -----END PGP SIGNATURE----- --83whgu5FDxMw6VeJQDg4v1h7T6ahWxfNX-- --===============5902562234248317447== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce --===============5902562234248317447==-- |