Your message dated Sat, 17 Oct 2026 14:33:38 +0000
with message-id <[email protected]>
and subject line Bug#1148902: fixed in librsvg 2.60.0+dfsg-1+deb13u1
has caused the Debian Bug report #1148902,
regarding librsvg: CVE-2026-96889
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148902: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148902
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: librsvg
Version: 2.62.1+dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for librsvg.
CVE-2026-96889[0]:
| A flaw was found in librsvg. When processing an SVG document
| containing nested XML inclusions (Xincludes) with duplicate entity
| declarations, a use-after-free error can occur. This vulnerability
| arises because the library incorrectly frees an XML entity that is
| still in use by the parser. An attacker could potentially exploit
| this to cause a denial of service or execute arbitrary code.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-96889
https://www.cve.org/CVERecord?id=CVE-2026-96889
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2539279
[2] https://rustsec.org/advisories/RUSTSEC-2026-0305.html
[3] https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
[4]
https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: librsvg
Source-Version: 2.60.0+dfsg-1+deb13u1
Done: Moritz Mühlenhoff <[email protected]>
We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Moritz Mühlenhoff <[email protected]> (supplier of updated librsvg package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 07 Oct 2026 00:03:53 +0200
Source: librsvg
Architecture: source
Version: 2.60.0+dfsg-1+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Moritz Mühlenhoff <[email protected]>
Closes: 1148902
Changes:
librsvg (2.60.0+dfsg-1+deb13u1) trixie-security; urgency=medium
.
* CVE-2026-96889 (Closes: #1148902)
Checksums-Sha1:
202c730587c076f7c93b2c579bc5abf4c05b41cb 3089 librsvg_2.60.0+dfsg-1+deb13u1.dsc
d5bede0ff479277fc8578bc89f328de79290fbfd 6735208
librsvg_2.60.0+dfsg.orig.tar.xz
5c20fd47882d4627d52567c3431fc149311a6aeb 10833628
librsvg_2.60.0+dfsg-1+deb13u1.debian.tar.xz
b606b96d71b6b8a5d036adb7d113318a4fb87f24 16154
librsvg_2.60.0+dfsg-1+deb13u1_amd64.buildinfo
Checksums-Sha256:
1653a531d1e0374318197cc008c3b9a4286d5e178d34c52a38f2b867d4f56fc2 3089
librsvg_2.60.0+dfsg-1+deb13u1.dsc
1b9f126ad3115e4126c682f3011023a05dcf19a69e5e878fbffb420ade671b81 6735208
librsvg_2.60.0+dfsg.orig.tar.xz
8ba361c954a3337a0257ce46960bfc874c99912381b9342a475db6c6422203bf 10833628
librsvg_2.60.0+dfsg-1+deb13u1.debian.tar.xz
7dbffe4d1142bfea2a908578688bb57f981c0f49b160af3b716c14ab6ba3ae2e 16154
librsvg_2.60.0+dfsg-1+deb13u1_amd64.buildinfo
Files:
7d08d16f04427f870d116182b24e13ac 3089 libs optional
librsvg_2.60.0+dfsg-1+deb13u1.dsc
81c109a434a07a979ef33b3294d5e447 6735208 libs optional
librsvg_2.60.0+dfsg.orig.tar.xz
794c5ba3e03ddc856fd0ae1c1daebc9c 10833628 libs optional
librsvg_2.60.0+dfsg-1+deb13u1.debian.tar.xz
13247c1cc7be116accfc586e4ee14a05 16154 libs optional
librsvg_2.60.0+dfsg-1+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmrGiZEACgkQEMKTtsN8
Tja9SQ//UDqnGxuMhcjHRlbITvbgOAyNBPL0ywLTelG7hQPv8boQydjTBPTBeI2C
3vSlif9LOCVFmrQQyZlNlsiUKUy5CdgZ+MJw3/BYmChtEe3sZvmZMKm/tV+V04X0
hWWG9BFbMCMmEZTV7bor8ycrtWrse4r15gSDWT9k39tmBEdu015vgnXdYJMgYUNw
lsB3THpwkZoy3Ws9DmEZ+iHfNTNIYiYv4DbfIkhqJU6dHi9xafkB2TiNszgQJdkc
yVIHDDemko36wHUPccxSNbTARF1jE5q/HCvPAmovX0GGuBo9HGCuDMArcwtRaSJx
di46pf8ZnDnSsGpdLlcRyWSc2UDPoML87SO9yDNXZqd3Q6TAfxrkXDOi6yhUGE4z
SXdEJJVlch34tq+VgKwKJoWsA7gspOte/FLknpDb3p3vkSwLzQuBgmnun01cK3vL
N/HZRSkqeepU0eLQRBkXs8lwfjohjv1G3b+8EeISo07JMTyStnAtV/0F1sTGWQ+q
eSn7OY/RF7r2WpjmdyTlQXoQmxhe+e5WJ8C2ygDWsEjvKdMDT9/Q3/4/qpbpzmeu
gfj+ry5KFWqaZqbFV1S6ff3gL1eVMx9CJmzC2EdszRpjhkQzeOUMu0W6Wpp0boUY
EXaTqzxkA2IhzM8SHOwjA+CSfEmyLVZziltD0Fb9P4JFni1at9M=
=5cKZ
-----END PGP SIGNATURE-----
pgpv7Rg4VCCsz.pgp
Description: PGP signature
--- End Message ---
