Regression in USN-4436-1

Bug #1889206 reported by Marc Deslauriers
272
This bug affects 4 people
Affects Status Importance Assigned to Milestone
librsvg
Fix Released
Unknown
librsvg (Ubuntu)
Xenial
Fix Released
Undecided
Marc Deslauriers
Bionic
Fix Released
Undecided
Marc Deslauriers

Bug Description

The security fix for librsvg introduced a regression in aisleriot.

Steps to reproduce:

1- install gnome-cards-data
2- run "sol" to start Aislerot
3- Switch card layout to "Anglo"
4- Notice some cards are missing graphics

CVE References

Changed in librsvg (Ubuntu Xenial):
assignee: nobody → Marc Deslauriers (mdeslaur)
Changed in librsvg (Ubuntu Bionic):
assignee: nobody → Marc Deslauriers (mdeslaur)
Changed in librsvg (Ubuntu Xenial):
status: New → Confirmed
Changed in librsvg (Ubuntu Bionic):
status: New → Confirmed
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in librsvg (Ubuntu):
status: New → Confirmed
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Can also be tested by running "eog /usr/share/aisleriot/cards/anglo.svgz". See attached screenshot.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package librsvg - 2.40.13-3ubuntu0.2

---------------
librsvg (2.40.13-3ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: Regression when parsing Aisleriot cards (LP: #1889206)
    - debian/patches/CVE-2019-20446-*.patch: removed pending a complete
      fix.
    - debian/librsvg2-2.symbols: removed symbol.

 -- Marc Deslauriers <email address hidden> Tue, 28 Jul 2020 19:40:39 -0400

Changed in librsvg (Ubuntu Xenial):
status: Confirmed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package librsvg - 2.40.20-2ubuntu0.2

---------------
librsvg (2.40.20-2ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Regression when parsing Aisleriot cards (LP: #1889206)
    - debian/patches/CVE-2019-20446-*.patch: removed pending a complete
      fix.
    - debian/librsvg2-2.symbols: removed symbol.

 -- Marc Deslauriers <email address hidden> Tue, 28 Jul 2020 18:58:19 -0400

Changed in librsvg (Ubuntu Bionic):
status: Confirmed → Fix Released
Changed in librsvg (Ubuntu):
status: Confirmed → Invalid
Mathew Hodson (mhodson)
no longer affects: librsvg (Ubuntu)
Changed in librsvg:
status: Unknown → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.