CVEvulnerability
CVE-2023-38633
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-07-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
Description
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
Affected configurations
• gnome librsvg (>= 2.42.3 < 2.46.6)
• gnome librsvg (>= 2.48.0 < 2.48.11)
• gnome librsvg (>= 2.50.0 < 2.50.8)
• gnome librsvg (>= 2.52.0 < 2.52.10)
• gnome librsvg (>= 2.54.0 < 2.54.6)
• gnome librsvg (>= 2.55.0 < 2.55.3)
• gnome librsvg (>= 2.56.0 < 2.56.3)
• fedoraproject fedora 37
• fedoraproject fedora 38
• debian debian linux 11.0
• debian debian linux 12.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://seclists.org/fulldisclosure/2023/Jul/43 Mailing List, Not Applicable, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/07/27/1 Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/06/10 Mailing List
- https://bugzilla.suse.com/show_bug.cgi?id=1213502 Issue Tracking, Patch, Third Party Advisory
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996 Exploit, Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3 Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/ Third Party Advisory
- https://news.ycombinator.com/item?id=37415799 Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230831-0011/ Third Party Advisory
- https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/ Exploit, Technical Description, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5484 Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jul/43 Mailing List, Not Applicable, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/07/27/1 Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/06/10 Mailing List
- https://bugzilla.suse.com/show_bug.cgi?id=1213502 Issue Tracking, Patch, Third Party Advisory
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996 Exploit, Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3 Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/ Third Party Advisory
- https://news.ycombinator.com/item?id=37415799 Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230831-0011/ Third Party Advisory
- https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/ Exploit, Technical Description, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5484 Third Party Advisory