openSUSE Security Update: Security update for python-CairoSVG
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2023:0260-1
Rating:             moderate
References:         #1180648 #1209538 
Cross-References:   CVE-2021-21236 CVE-2023-27586
CVSS scores:
                    CVE-2021-21236 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2023-27586 (NVD) : 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Affected Products:
                    openSUSE Backports SLE-15-SP5
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for python-CairoSVG fixes the following issues:

   - CVE-2023-27586: Don't allow fetching external files unless explicitly
     asked for. (boo#1209538)

   - Update to version 2.5.2

     * Fix marker path scale

   - Update to version 2.5.1 (boo#1180648, CVE-2021-21236):

     * Security fix: When processing SVG files, CairoSVG was using two
       regular expressions which are vulnerable to Regular Expression Denial
       of Service (REDoS). If an attacker provided a malicious SVG, it could
       make CairoSVG get stuck processing the file for a very long time.
     * Fix marker positions for unclosed paths
     * Follow hint when only output_width or output_height is set
     * Handle opacity on raster images
     * Don’t crash when use tags reference unknown tags
     * Take care of the next letter when A/a is replaced by l
     * Fix misalignment in node.vertices

   - Updates for version 2.5.0.

     * Drop support of Python 3.5, add support of Python 3.9.
     * Add EPS export
     * Add background-color, negate-colors, and invert-images options
     * Improve support for font weights
     * Fix opacity of patterns and gradients
     * Support auto-start-reverse value for orient
     * Draw images contained in defs
     * Add Exif transposition support
     * Handle dominant-baseline
     * Support transform-origin


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP5:

      zypper in -t patch openSUSE-2023-260=1



Package List:

   - openSUSE Backports SLE-15-SP5 (noarch):

      python3-CairoSVG-2.5.2-bp155.3.3.1


References:

   https://www.suse.com/security/cve/CVE-2021-21236.html
   https://www.suse.com/security/cve/CVE-2023-27586.html
   https://bugzilla.suse.com/1180648
   https://bugzilla.suse.com/1209538

openSUSE: 2023:0260-1 moderate: python-CairoSVG

September 25, 2023
An update that fixes two vulnerabilities is now available

Description

This update for python-CairoSVG fixes the following issues: - CVE-2023-27586: Don't allow fetching external files unless explicitly asked for. (boo#1209538) - Update to version 2.5.2 * Fix marker path scale - Update to version 2.5.1 (boo#1180648, CVE-2021-21236): * Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time. * Fix marker positions for unclosed paths * Follow hint when only output_width or output_height is set * Handle opacity on raster images * Don’t crash when use tags reference unknown tags * Take care of the next letter when A/a is replaced by l * Fix misalignment in node.vertices - Updates for version 2.5.0. * Drop support of Python 3.5, add support of Python 3.9. * Add EPS export * Add background-color, negate-colors, and invert-images options * Improve support for font weights * Fix opacity of patterns and gradients * Support auto-start-reverse value for orient * Draw images contained in defs * Add Exif transposition support * Handle dominant-baseline * Support transform-origin

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-260=1


Package List

- openSUSE Backports SLE-15-SP5 (noarch): python3-CairoSVG-2.5.2-bp155.3.3.1


References

https://www.suse.com/security/cve/CVE-2021-21236.html https://www.suse.com/security/cve/CVE-2023-27586.html https://bugzilla.suse.com/1180648 https://bugzilla.suse.com/1209538


Severity
Announcement ID: openSUSE-SU-2023:0260-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP5 .

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo