CVE-2023-38633

Name
CVE-2023-38633
Description
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
MISC https://bugzilla.suse.com/show_bug.cgi?id=1213502
MISC https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
MLIST http://www.openwall.com/lists/oss-security/2023/07/27/1
FULLDISC http://seclists.org/fulldisclosure/2023/Jul/43
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
DEBIAN https://www.debian.org/security/2023/dsa-5484
CONFIRM https://security.netapp.com/advisory/ntap-20230831-0011/
MLIST http://www.openwall.com/lists/oss-security/2023/09/06/10
MISC https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
MISC https://news.ycombinator.com/item?id=37415799
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= None < 2.46.6
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.48.0 < 2.48.11
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.50.0 < 2.50.8
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.52.0 < 2.52.10
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.54.0 < 2.54.6
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.55.0 < 2.55.3
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.56.0 < 2.56.3
cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:* librsvg >= 2.42.3 < 2.46.6

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
librsvg edge-community 2.56.3-r0 psykose <alice@ayaya.dev> fixed
librsvg edge-community 2.50.4-r0 Rasmus Thomsen <oss@cogitri.dev> possibly vulnerable
librsvg edge-community 2.46.2-r0 None possibly vulnerable
librsvg 3.22-community 2.56.3-r0 None fixed
librsvg 3.22-community 2.50.4-r0 None possibly vulnerable
librsvg 3.22-community 2.46.2-r0 None possibly vulnerable
librsvg 3.21-community 2.56.3-r0 None fixed
librsvg 3.20-community 2.56.3-r0 None fixed
librsvg 3.19-community 2.56.3-r0 None fixed
librsvg 3.18-community 2.56.3-r0 psykose <alice@ayaya.dev> fixed