CVE-2017-11464

NameCVE-2017-11464
DescriptionA SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2285-1
Debian Bugs869129

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
librsvg (PTS)bullseye (security), bullseye2.50.3+dfsg-1+deb11u1fixed
bookworm, bookworm (security)2.54.7+dfsg-1~deb12u1fixed
sid, trixie2.59.1+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librsvgsourcewheezy(not affected)
librsvgsourcejessie(not affected)
librsvgsourcestretch2.40.21-0+deb9u1DLA-2285-1
librsvgsource(unstable)2.40.18-1869129

Notes

[jessie] - librsvg <not-affected> (Vulnerable code introduced in 2.40.9)
[wheezy] - librsvg <not-affected> (Vulnerable code introduced in 2.40.9)
https://bugzilla.gnome.org/show_bug.cgi?id=783835
Introduced in: https://git.gnome.org/browse/librsvg/commit/?id=054807726db76558728e7a7513aabc4698b3dc95 (2.40.9)
Fixed by: https://git.gnome.org/browse/librsvg/commit/?id=ecf9267a24b2c3c0cd211dbdfa9ef2232511972a

Search for package or bug name: Reporting problems