Read the docs
TI-2011-02776 Aliases CVE-2011-3146GHSA-x9rw-3x6c-c4h9

librsvg before 2.34.1 uses the node name to identify the type of node, which allows…

Priority LOW 37Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.

Why it matters now

EPSS 0.04418 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*up to 2.34.0VulnerableGNOME
  • cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* Versions up to 2.34.0 Vulnerable ·GNOME

Remediation

Red Hat 1 advisory

  • RHSA-2011:1289 Released 2011-09-13 · Red Hat rating Moderate
    librsvg2 security update
    • Red Hat Enterprise Linux Server (v. 6) librsvg2-2.26.0-5.el6_1.1, librsvg2-2.26.0-5.el6_1.1.ppc, librsvg2-devel-2.26.0-5.el6_1.1 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1289
Not affected: 2 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3146
  2. 2026-10-03 Alias added: GHSA-x9rw-3x6c-c4h9

References

Exploit 1

Advisory 4

Other 4

  • TI-2018-15701 GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a… CVSS 3.0HIGH 8.8
  • TI-2017-08480 A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg… CVSS 3.0HIGH 7.8
  • TI-2016-03730 The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent… CVSS 3.0HIGH 7.5
  • TI-2015-06285 librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service… CVSS 3.0HIGH 7.5
  • TI-2015-06284 The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows… CVSS 3.0HIGH 7.5
  • TI-2019-14678 In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can… CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences