CVE-2018-1000041
High
Description
GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Gnome Librsvg
PublishedFeb 9, 2018
First seenFeb 9, 2018
How to fix
Update
- gnome librsvg2.41.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnome librsvg | v < 2.41.2 | 2.41.2 |
| debian debian_linux | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.