PatchTheCVElunasvg vulnerabilities and fixes
Recent CVEs affecting lunasvg, with upgrade or downgrade steps. 12 tracked.
lunasvg has 12 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-02-03. Highest priority: CVE-2024-33768 (score 59/100).
- CVE-2024-57724 MEDIUM 6.5 DOWNGRADE lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.
- CVE-2024-57723 MEDIUM 6.5 DOWNGRADE lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.
- CVE-2024-57722 HIGH 7.5 DOWNGRADE lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_creat
- CVE-2024-57721 MEDIUM 6.5 DOWNGRADE lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.
- CVE-2024-57720 MEDIUM 6.5 DOWNGRADE lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.
- CVE-2024-57719 MEDIUM 6.5 DOWNGRADE lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_ar
- CVE-2024-55456 MEDIUM 6.5 DOWNGRADE lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
- CVE-2024-33768 CRITICAL 9.8 DOWNGRADE lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_o
- CVE-2024-33767 MEDIUM 5.0 DOWNGRADE lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.
- CVE-2024-33766 MEDIUM 5.3 DOWNGRADE lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isr
- CVE-2024-33764 MEDIUM 5.5 DOWNGRADE lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.
- CVE-2024-33763 HIGH 7.5 DOWNGRADE lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.
FAQ
How do I fix lunasvg vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lunasvg being exploited right now?
None of the tracked lunasvg CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lunasvg CVE should I patch first?
CVE-2024-33768 currently ranks highest (59/100): lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_o.