Description
An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Talos | Computerinsel Photoline | 20.02 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | libofx | 0.9.9-3.7.1 | SUSE-SU-2018:2064-1 |
| SLES 11 SP4 | libofx | 0.9.0-3.7.1 | SUSE-SU-2018:2045-1 |
Advisories 2
- SUSE-SU-2018:2064-1 Security update for libofx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2045-1 Security update for libofx SUSE / openSUSE Security Updates · Feb 4, 2026