<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for librsvg</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2020:0629-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-07-07T11:45:14Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-07-07T11:45:14Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-07-07T11:45:14Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for librsvg</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for librsvg to version 2.42.8 fixes the following issues:

librsvg was updated to version 2.42.8 fixing the following issues:	  

- CVE-2019-20446: Fixed an issue where a crafted SVG file with nested
  patterns can cause denial of service (bsc#1162501).
  NOTE: Librsvg now has limits on the number of loaded XML elements,
  and the number of referenced elements within an SVG document. 
- Fixed a stack exhaustion with circular references in &lt;use&gt;
  elements.
- Fixed a denial-of-service condition from exponential explosion
  of rendered elements, through nested use of SVG 'use' elements in
  malicious SVGs.  
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Image SLES15-SAP-Azure-LI-BYOS-Production-2020-629,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-629,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-629,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-629,SUSE-2020-629,SUSE-SLE-Module-Basesystem-15-SP1-2020-629,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-629,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-629</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20200629-1/</URL>
      <Description>Link for SUSE-SU-2020:0629-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2020-March/006591.html</URL>
      <Description>E-Mail link for SUSE-SU-2020:0629-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1162501</URL>
      <Description>SUSE Bug 1162501</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-20446/</URL>
      <Description>SUSE CVE CVE-2019-20446 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Image SLES15-SAP-Azure-LI-BYOS-Production">
      <Branch Type="Product Name" Name="Image SLES15-SAP-Azure-LI-BYOS-Production">
        <FullProductName ProductID="Image SLES15-SAP-Azure-LI-BYOS-Production">Image SLES15-SAP-Azure-LI-BYOS-Production</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES15-SAP-Azure-VLI-BYOS-Production">
      <Branch Type="Product Name" Name="Image SLES15-SAP-Azure-VLI-BYOS-Production">
        <FullProductName ProductID="Image SLES15-SAP-Azure-VLI-BYOS-Production">Image SLES15-SAP-Azure-VLI-BYOS-Production</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production">
      <Branch Type="Product Name" Name="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production">
        <FullProductName ProductID="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production">Image SLES15-SP1-SAP-Azure-LI-BYOS-Production</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production">
      <Branch Type="Product Name" Name="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production">
        <FullProductName ProductID="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production">Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Basesystem 15 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP1" CPE="cpe:/o:suse:sle-module-basesystem:15:sp1">SUSE Linux Enterprise Module for Basesystem 15 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Desktop Applications 15 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Desktop Applications 15 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15 SP1" CPE="cpe:/o:suse:sle-module-desktop-applications:15:sp1">SUSE Linux Enterprise Module for Desktop Applications 15 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">
      <FullProductName ProductID="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="librsvg-2-2-2.42.8-3.3.1">
      <FullProductName ProductID="librsvg-2-2-2.42.8-3.3.1">librsvg-2-2-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gdk-pixbuf-loader-rsvg-32bit-2.42.8-3.3.1">
      <FullProductName ProductID="gdk-pixbuf-loader-rsvg-32bit-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-32bit-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="gdk-pixbuf-loader-rsvg-64bit-2.42.8-3.3.1">
      <FullProductName ProductID="gdk-pixbuf-loader-rsvg-64bit-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-64bit-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="librsvg-2-2-32bit-2.42.8-3.3.1">
      <FullProductName ProductID="librsvg-2-2-32bit-2.42.8-3.3.1">librsvg-2-2-32bit-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="librsvg-2-2-64bit-2.42.8-3.3.1">
      <FullProductName ProductID="librsvg-2-2-64bit-2.42.8-3.3.1">librsvg-2-2-64bit-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="librsvg-devel-2.42.8-3.3.1">
      <FullProductName ProductID="librsvg-devel-2.42.8-3.3.1">librsvg-devel-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="rsvg-thumbnailer-2.42.8-3.3.1">
      <FullProductName ProductID="rsvg-thumbnailer-2.42.8-3.3.1">rsvg-thumbnailer-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="rsvg-view-2.42.8-3.3.1">
      <FullProductName ProductID="rsvg-view-2.42.8-3.3.1">rsvg-view-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="typelib-1_0-Rsvg-2_0-2.42.8-3.3.1">
      <FullProductName ProductID="typelib-1_0-Rsvg-2_0-2.42.8-3.3.1">typelib-1_0-Rsvg-2_0-2.42.8-3.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SAP-Azure-LI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SAP-Azure-LI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-2.42.8-3.3.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="librsvg-2-2-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SAP-Azure-LI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SAP-Azure-LI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1">librsvg-2-2-2.42.8-3.3.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SAP-Azure-VLI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SAP-Azure-VLI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-2.42.8-3.3.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="librsvg-2-2-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SAP-Azure-VLI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SAP-Azure-VLI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1">librsvg-2-2-2.42.8-3.3.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-2.42.8-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="librsvg-2-2-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1">librsvg-2-2-2.42.8-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-2.42.8-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="librsvg-2-2-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production">
      <FullProductName ProductID="Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1">librsvg-2-2-2.42.8-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production</FullProductName>
    </Relationship>
    <Relationship ProductReference="gdk-pixbuf-loader-rsvg-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP1:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1">gdk-pixbuf-loader-rsvg-2.42.8-3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="librsvg-2-2-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP1:librsvg-2-2-2.42.8-3.3.1">librsvg-2-2-2.42.8-3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="librsvg-devel-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Desktop Applications 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15 SP1:librsvg-devel-2.42.8-3.3.1">librsvg-devel-2.42.8-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="typelib-1_0-Rsvg-2_0-2.42.8-3.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Desktop Applications 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15 SP1:typelib-1_0-Rsvg-2_0-2.42.8-3.3.1">typelib-1_0-Rsvg-2_0-2.42.8-3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.</Note>
    </Notes>
    <CVE>CVE-2019-20446</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES15-SAP-Azure-LI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SAP-Azure-LI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SAP-Azure-VLI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SAP-Azure-VLI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1</ProductID>
        <ProductID>Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:librsvg-2-2-2.42.8-3.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP1:gdk-pixbuf-loader-rsvg-2.42.8-3.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP1:librsvg-2-2-2.42.8-3.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15 SP1:librsvg-devel-2.42.8-3.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15 SP1:typelib-1_0-Rsvg-2_0-2.42.8-3.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20200629-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-20446.html</URL>
        <Description>CVE-2019-20446</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1162501</URL>
        <Description>SUSE Bug 1162501</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
