DescriptionA SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs869129

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
librsvg (PTS)wheezy2.36.1-2+deb7u1fixed
wheezy (security)2.36.1-2+deb7u3fixed
jessie (security), jessie2.40.5-1+deb8u2fixed
buster, sid2.40.20-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librsvgsourcejessie(not affected)
librsvgsourcewheezy(not affected)


[stretch] - librsvg <no-dsa> (Minor issue)
[jessie] - librsvg <not-affected> (Vulnerable code introduced in 2.40.9)
[wheezy] - librsvg <not-affected> (Vulnerable code introduced in 2.40.9)
Introduced in: (2.40.9)
Fixed by:

Search for package or bug name: Reporting problems