perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.

• http://www.securityfocus.com/bid/94220
• http://www.openwall.com/lists/oss-security/2016/11/04/2