CVE-2023-38633 | BDVDB-2026-207900 Detail
Description#
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
- https://bugzilla.suse.com/show_bug.cgi?id=1213502
- https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
- http://seclists.org/fulldisclosure/2023/Jul/43
- http://www.openwall.com/lists/oss-security/2023/07/27/1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/
- https://www.debian.org/security/2023/dsa-5484
- https://security.netapp.com/advisory/ntap-20230831-0011/
- http://www.openwall.com/lists/oss-security/2023/09/06/10
- https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
- https://news.ycombinator.com/item?id=37415799
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.