CVE-2023-38633
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local f...
Original description
The description as published by the source.
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-38633 librsvg Fixed in: 2.50.3+dfsg-1+deb11u1
References
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory debian.org
- report bugzilla.suse.com
- report gitlab.gnome.org
- web gitlab.gnome.org
- web news.ycombinator.com
- web seclists.org
- web openwall.com
- web openwall.com
- web canva.dev