TI-2015-06284 Aliases CVE-2015-7557 GHSA-25xx-qj5q-8gm9

The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows…

LOW 37CWE-20Published 2016-05-20 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.

Why it matters now

EPSS 0.02027 81st percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gnome:librsvg::::::::	up to 2.40.6	Vulnerable	GNOME

cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* Versions up to 2.40.6 Vulnerable ·GNOME

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2015-7557
2026-10-03 Alias added: GHSA-25xx-qj5q-8gm9

References

Advisory 2

Other 1

[oss-security] 20151221 CVE-2015-7557, CVE-2015-7558 librsvg2: Out-of-bounds heap read and stack exhaustion

TI-2018-15701 GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a… CVSS 3.0HIGH 8.8
TI-2017-08480 A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg… CVSS 3.0HIGH 7.8
TI-2016-03730 The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent… CVSS 3.0HIGH 7.5
TI-2015-06285 librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service… CVSS 3.0HIGH 7.5
TI-2011-02776 librsvg before 2.34.1 uses the node name to identify the type of node, which allows… CVSS 2.0MEDIUM 6.8
TI-2019-14678 In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can… CVSS 3.1MEDIUM 6.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences