CVE-2017-11464

What it actually does

Incorrect bounds checking in box_blur_line of rsvg-filter.c allows a crafted SVG filter to trigger integer division by zero, raising SIGFPE and terminating the process.

Why it matters to the business

Applications that render SVG images can be forced to crash when a user opens or previews a malicious file, interrupting document workflows and requiring restarts or process recovery.

How an attack unfolds

An attacker crafts an SVG containing a blur filter with parameters that reach the unprotected division in box_blur_line. When the target application parses and renders the SVG using the vulnerable librsvg library, the division by zero occurs and the process terminates.

How to fix it

Upgrade gnome/librsvg to the commit ecf9267a24b2c3c0cd211dbdfa9ef2232511972a or a later release that contains the division-by-zero guard.

How to confirm the fix worked

Rebuild or install the fixed commit, then attempt to render the original proof-of-concept SVG and confirm the process no longer receives SIGFPE. Verify the installed library reports the corrected commit hash.

Typical attack path

1. Create a minimal SVG file embedding a filter primitive that sets up the division-by-zero condition
2. Deliver the SVG via email attachment, web page, document, or shared file
3. Victim application opens or renders the SVG using librsvg
4. box_blur_line executes the faulty division, raising SIGFPE and crashing the process

How to detect it

Review application crash logs for SIGFPE originating from rsvg-filter.c or box_blur_line; correlate with recent receipt of SVG files that were not previously processed successfully.

What your security team should do

• Immediately update all instances of librsvg to the fixed commit
• Scan package manifests and container images for the vulnerable 2.40.17 version
• Add SVG rendering to sandbox or seccomp profiles until patches are deployed