Vulnerability · Published Jul 22, 2023 · Assigned by mitre
CVE-2023-38633
Medium 5.5
In plain English
A medium-severity security flaw in the librsvg2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)2.3%top 16.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | librsvg2 | 2.50.7-1.el9_2.1 | ALSA-2023:5081 |
| AlmaLinux:9 | librsvg2-devel | 2.50.7-1.el9_2.1 | ALSA-2023:5081 |
| AlmaLinux:9 | librsvg2-tools | 2.50.7-1.el9_2.1 | ALSA-2023:5081 |
| Alpine:v3.20 | librsvg | 2.56.3-r0 | ALPINE-CVE-2023-38633 |
| Alpine:v3.21 | librsvg | 2.56.3-r0 | ALPINE-CVE-2023-38633 |
| Alpine:v3.22 | librsvg | 2.56.3-r0 | ALPINE-CVE-2023-38633 |
| Alpine:v3.23 | librsvg | 2.56.3-r0 | ALPINE-CVE-2023-38633 |
| Alpine:v3.24 | librsvg | 2.56.3-r0 | ALPINE-CVE-2023-38633 |
| Debian:12 | librsvg | 2.54.7+dfsg-1~deb12u1 | DSA-5484-1 |
| Debian:12 | librsvg | 2.54.7+dfsg-1~deb12u1 | DEBIAN-CVE-2023-38633 |
| Debian:13 | librsvg | 2.54.7+dfsg-1 | DEBIAN-CVE-2023-38633 |
| Debian:14 | librsvg | 2.54.7+dfsg-1 | DEBIAN-CVE-2023-38633 |
| Ubuntu:22.04:LTS | librsvg | 2.52.5+dfsg-3ubuntu0.2 | UBUNTU-CVE-2023-38633 |
| Ubuntu:22.04:LTS | librsvg | 2.52.5+dfsg-3ubuntu0.2 | USN-6266-1 |
Affected products (as reported)
References
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
- https://bugzilla.suse.com/show_bug.cgi?id=1213502
- https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
- 20230724 APPLE-SA-2023-07-24-1 Safari 16.6 mailing-list
- [oss-security] 20230727 CVE-2023-38633 in librsvg: Arbitrary file read when xinclude href has special characters mailing-list
- FEDORA-2023-fc79ee273d vendor-advisory
- FEDORA-2023-0873c38acd vendor-advisory
- DSA-5484 vendor-advisory
- https://security.netapp.com/advisory/ntap-20230831-0011/
- [oss-security] 20230906 Re: CVE-2023-38633 in librsvg: Arbitrary file read when xinclude href has special characters mailing-list
- https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
- https://news.ycombinator.com/item?id=37415799