PT-2013-01: XML External Entity Injection in GNOME

Vulnerable software

Version 3.8.1 and earlier

Application link:

Severity level

Severity level: Medium
Impact: Internal Network Resources Access, File System Access
Access Vector: Local  

CVSS v2: 
Base Score: 6.6 
Vector: (AV:L/AC:L/Au:N/C:C/I:N/A:C)


Software description

GNOME is a desktop environment and graphical user interface that runs on top of a computer operating system.

Vulnerability description

Positive Research Center experts have detected a local resources access vulnerability (files and internal network resources) via  XML External Entity enabled in GNOME.

An attacker is able to give a user a specially crafted file. If he or she views a folder with the file or opens it, librsvg sends local resource's contents  to the attacker's server.

How to fix

Update your software up to the latest version.

Advisory status

14.01.2013 - Vendor gets vulnerability details
16.05.2013 - Vendor releases fixed version and details
20.06.2013 - Public disclosure


This vulnerability have discovered by Timur Yunusov and Alexey Osipov, Positive Research Center (Positive Technologies Company)


Reports on the vulnerabilities previously discovered by Positive Research: