openSUSE: 2023:0272-1 Moderate: Python-CairoSVG External File Fetching
opensuse
September 26, 2023
An update that fixes two vulnerabilities is now available
Description
This update for python-CairoSVG fixes the following issues:
- CVE-2023-27586: Don't allow fetching external files unless explicitly
asked for. (boo#1209538)
- Update to version 2.5.2
* Fix marker path scale
- Update to version 2.5.1 (boo#1180648, CVE-2021-21236):
* Security fix: When processing SVG files, CairoSVG was using two
regular expressions which are vulnerable to Regular Expression Denial
of Service (REDoS). If an attacker provided a malicious SVG, it could
make CairoSVG get stuck processing the file for a very long time.
* Fix marker positions for unclosed paths
* Follow hint when only output_width or output_height is set
* Handle opacity on raster images
* Donât crash when use tags reference unknown tags
* Take care of the next letter when A/a is replaced by l
* Fix misalignment in node.vertices
- Updates for version 2.5.0.
* Drop support of Python 3.5, add support of Python...
Read the Full Advisory
Patch
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP4:
zypper in -t patch openSUSE-2023-272=1
Package List
- openSUSE Backports SLE-15-SP4 (noarch):
python3-CairoSVG-2.5.2-bp154.2.3.1
References
https://www.suse.com/security/cve/CVE-2021-21236.html
https://www.suse.com/security/cve/CVE-2023-27586.html
https://bugzilla.suse.com/1180648
https://bugzilla.suse.com/1209538
PREVIOUS
NEXT
Announcement ID: openSUSE-SU-2023:0272-1
Rating: moderate
Affected Products:
openSUSE Backports SLE-15-SP4
.
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!