CVE-2023-38633
- Source
- https://cve.org/CVERecord?id=CVE-2023-38633
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38633.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-38633
- Downstream
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (2)
UBUNTU (1)
- Related
- Published
- 2023-07-22T00:00:00Z
- Modified
- 2026-10-21T02:30:20Z
- Summary
- [none]
- Details
-
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
- Database specific
{ "cna_assigner": "mitre", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38633.json" }- References
-
- https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
- https://news.ycombinator.com/item?id=37415799
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38633.json
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
- https://nvd.nist.gov/vuln/detail/CVE-2023-38633
- https://security.netapp.com/advisory/ntap-20230831-0011/
- https://www.debian.org/security/2023/dsa-5484
- https://bugzilla.suse.com/show_bug.cgi?id=1213502
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
- http://seclists.org/fulldisclosure/2023/Jul/43
- http://www.openwall.com/lists/oss-security/2023/07/27/1
- http://www.openwall.com/lists/oss-security/2023/09/06/10
- https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
Affected packages
Git / github.com/gnome/librsvg
Affected ranges
- Type
- GIT
- Repo
- https://github.com/gnome/librsvg
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.42.3" }, { "fixed": "2.46.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.48.0" }, { "fixed": "2.48.11" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.50.0" }, { "fixed": "2.50.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.52.0" }, { "fixed": "2.52.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.54.0" }, { "fixed": "2.54.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.55.0" }, { "fixed": "2.55.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.56.0" }, { "fixed": "2.56.3" } ], "source": "CPE_RANGE" } ] }
- Type
- GIT
- Repo
- https://gitlab.gnome.org/gnome/librsvg
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.42.3" }, { "fixed": "2.46.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.48.0" }, { "fixed": "2.48.11" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.50.0" }, { "fixed": "2.50.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.52.0" }, { "fixed": "2.52.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.54.0" }, { "fixed": "2.54.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.55.0" }, { "fixed": "2.55.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:gnome:librsvg:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.56.0" }, { "fixed": "2.56.3" } ], "source": "CPE_RANGE" } ] }
Affected versions
2.*
2.48.0
2.48.1
2.48.10
2.48.2
2.48.3
2.48.4
2.48.5
2.48.6
2.48.7
2.48.8
2.48.9
2.50.0
2.50.1
2.50.2
2.50.3
2.50.4
2.50.5
2.50.6
2.50.7
2.52.0
2.52.1
2.52.2
2.52.3
2.52.4
2.52.5
2.52.6
2.52.7
2.52.8
2.52.9
2.54.0
2.54.1
2.54.2
2.54.3
2.54.4
2.54.5
2.55.0
2.55.1
2.55.2
2.56.0
2.56.1
2.56.2