SB2025121873 - SUSE update for librsvg

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2024-12224)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error within the UTS 46 specification when handling Punycode labels that do not produce any non-ASCII output. A remote attacker can construct a specially crafted hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

2) Resource exhaustion (CVE-ID: CVE-2024-43806)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when scanning directories. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-20254411-1/