OESA-2023-1582

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1582

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2023-1582.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2023-1582

Upstream

CVE-2023-38633

Published

2023-09-02T11:05:49Z

Modified

2025-09-03T06:19:20.514943Z

Summary

librsvg2 security update

Details

An SVG library based on cairo.

Security Fix(es):

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.(CVE-2023-38633)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:20.03-LTS-SP1 / librsvg2

Package

Name: librsvg2
Purl: pkg:rpm/openEuler/librsvg2&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.50.5-2.oe1

Ecosystem specific

{
    "src": [
        "librsvg2-2.50.5-2.oe1.src.rpm"
    ],
    "x86_64": [
        "librsvg2-debugsource-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-devel-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-tools-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-debuginfo-2.50.5-2.oe1.x86_64.rpm"
    ],
    "noarch": [
        "librsvg2-help-2.50.5-2.oe1.noarch.rpm"
    ],
    "aarch64": [
        "librsvg2-debugsource-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-devel-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-debuginfo-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-tools-2.50.5-2.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / librsvg2

Package

Name: librsvg2
Purl: pkg:rpm/openEuler/librsvg2&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.50.5-2.oe1

Ecosystem specific

{
    "src": [
        "librsvg2-2.50.5-2.oe1.src.rpm"
    ],
    "x86_64": [
        "librsvg2-tools-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-debugsource-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-debuginfo-2.50.5-2.oe1.x86_64.rpm",
        "librsvg2-devel-2.50.5-2.oe1.x86_64.rpm"
    ],
    "noarch": [
        "librsvg2-help-2.50.5-2.oe1.noarch.rpm"
    ],
    "aarch64": [
        "librsvg2-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-devel-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-tools-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-debuginfo-2.50.5-2.oe1.aarch64.rpm",
        "librsvg2-debugsource-2.50.5-2.oe1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS / librsvg2

Package

Name: librsvg2
Purl: pkg:rpm/openEuler/librsvg2&distro=openEuler-22.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.50.5-4.oe2203sp2

Ecosystem specific

{
    "src": [
        "librsvg2-2.50.5-6.oe2203.src.rpm",
        "librsvg2-2.50.5-6.oe2203sp1.src.rpm",
        "librsvg2-2.50.5-4.oe2203sp2.src.rpm"
    ],
    "x86_64": [
        "librsvg2-devel-2.50.5-6.oe2203.x86_64.rpm",
        "librsvg2-tools-2.50.5-6.oe2203.x86_64.rpm",
        "librsvg2-debugsource-2.50.5-6.oe2203.x86_64.rpm",
        "librsvg2-2.50.5-6.oe2203.x86_64.rpm",
        "librsvg2-debuginfo-2.50.5-6.oe2203.x86_64.rpm",
        "librsvg2-devel-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-debugsource-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-tools-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-debuginfo-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-debuginfo-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-debugsource-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-tools-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-devel-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-2.50.5-4.oe2203sp2.x86_64.rpm"
    ],
    "noarch": [
        "librsvg2-help-2.50.5-6.oe2203.noarch.rpm",
        "librsvg2-help-2.50.5-6.oe2203sp1.noarch.rpm",
        "librsvg2-help-2.50.5-4.oe2203sp2.noarch.rpm"
    ],
    "aarch64": [
        "librsvg2-debugsource-2.50.5-6.oe2203.aarch64.rpm",
        "librsvg2-2.50.5-6.oe2203.aarch64.rpm",
        "librsvg2-devel-2.50.5-6.oe2203.aarch64.rpm",
        "librsvg2-tools-2.50.5-6.oe2203.aarch64.rpm",
        "librsvg2-debuginfo-2.50.5-6.oe2203.aarch64.rpm",
        "librsvg2-debuginfo-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-tools-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-devel-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-debugsource-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-devel-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-debuginfo-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-tools-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-debugsource-2.50.5-4.oe2203sp2.aarch64.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / librsvg2

Package

Name: librsvg2
Purl: pkg:rpm/openEuler/librsvg2&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.50.5-6.oe2203sp1

Ecosystem specific

{
    "src": [
        "librsvg2-2.50.5-6.oe2203sp1.src.rpm"
    ],
    "x86_64": [
        "librsvg2-devel-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-debugsource-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-tools-2.50.5-6.oe2203sp1.x86_64.rpm",
        "librsvg2-debuginfo-2.50.5-6.oe2203sp1.x86_64.rpm"
    ],
    "noarch": [
        "librsvg2-help-2.50.5-6.oe2203sp1.noarch.rpm"
    ],
    "aarch64": [
        "librsvg2-debuginfo-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-tools-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-devel-2.50.5-6.oe2203sp1.aarch64.rpm",
        "librsvg2-debugsource-2.50.5-6.oe2203sp1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS-SP2 / librsvg2

Package

Name: librsvg2
Purl: pkg:rpm/openEuler/librsvg2&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.50.5-4.oe2203sp2

Ecosystem specific

{
    "src": [
        "librsvg2-2.50.5-4.oe2203sp2.src.rpm"
    ],
    "x86_64": [
        "librsvg2-debuginfo-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-debugsource-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-tools-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-devel-2.50.5-4.oe2203sp2.x86_64.rpm",
        "librsvg2-2.50.5-4.oe2203sp2.x86_64.rpm"
    ],
    "noarch": [
        "librsvg2-help-2.50.5-4.oe2203sp2.noarch.rpm"
    ],
    "aarch64": [
        "librsvg2-devel-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-debuginfo-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-tools-2.50.5-4.oe2203sp2.aarch64.rpm",
        "librsvg2-debugsource-2.50.5-4.oe2203sp2.aarch64.rpm"
    ]
}