CVE-2013-1881 XML external entity in n/a

Medium 4.3 Published 10 Oct 2013 Updated 6 Aug 2024

Remote attackers can read arbitrary files via crafted XML documents in GNOME libsvg, requiring user interaction to open the file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2013-1881?

CVE-2013-1881 is a medium-severity vulnerability in n/a, published on 10 Oct 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Weakness: CWE-20

Which versions are affected by CVE-2013-1881?

It affects 1 product.

Linux distribution packages (21)

`librsvg2` Red Hat:enterprise_linux:6::client	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-devel` Red Hat:enterprise_linux:6::client	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2` Red Hat:enterprise_linux:6::server	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-devel` Red Hat:enterprise_linux:6::server	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.26.0-6.el6_5.3`
`librsvg2-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.26.0-6.el6_5.3`
`librsvg` SUSE:Linux Enterprise Desktop 11 SP3	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Desktop 11 SP4	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Server 11 SP3	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Server 11 SP3-TERADATA	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Server 11 SP4	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Server for SAP Applications 11 SP3	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Software Development Kit 11 SP3	All versions	`2.26.0-2.5.1`
`librsvg` SUSE:Linux Enterprise Software Development Kit 11 SP4	All versions	`2.26.0-2.5.1`

Products include Gnome Librsvg.

How do I fix CVE-2013-1881?

Upgrade to a fixed version.

Is CVE-2013-1881 being exploited?

There is no known exploitation of CVE-2013-1881 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2013-1881, GHSA-w223-x3f9-926w, MGASA-2014-0004, RHSA-2014:0127, SUSE-SU-2015:1785-1.