CVE-2023-38633: in librsvg: Arbitrary file read when xinclude href has special characters

Published Jul 22, 2023
·
Updated

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

Affected Software

18 affected componentsFixes available
debian/librsvg<=2.54.5+dfsg-3, <=2.50.3+dfsg-1
2.54.7+dfsg-12.54.7+dfsg-1~deb12u12.50.3+dfsg-1+deb11u1
ubuntu/librsvg<2.56.91, <2.56.3, <2.55.3, <2.54.6, <2.52.10, <2.50.8, <2.48.11, <2.46.6
2.56.912.56.32.55.32.54.62.52.102.50.82.48.112.46.6
ubuntu/librsvg<2.48.9-1ubuntu0.20.04.4
2.48.9-1ubuntu0.20.04.4
ubuntu/librsvg<2.52.5+dfsg-3ubuntu0.2
2.52.5+dfsg-3ubuntu0.2
ubuntu/librsvg<2.54.5+dfsg-1ubuntu2.1
2.54.5+dfsg-1ubuntu2.1
debian/librsvg
2.44.10-2.1+deb10u32.50.3+dfsg-1+deb11u12.54.7+dfsg-1~deb12u12.54.7+dfsg-2
Gnome librsvg<2.46.6
Gnome librsvg>=2.48.0<2.48.11
Gnome librsvg>=2.50.0<2.50.8
Gnome librsvg>=2.52.0<2.52.10
Gnome librsvg>=2.54.0<2.54.6
Gnome librsvg>=2.55.0<2.55.3
Gnome librsvg>=2.56.0<2.56.3
Fedoraproject Fedora=38
Gnome librsvg>=2.42.3<2.46.6
Fedoraproject Fedora=37
Debian Debian Linux=11.0
Debian Debian Linux=12.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/librsvg to a version that resolves this vulnerability.

    Fixed in 2.54.7+dfsg-1Fixed in 2.54.7+dfsg-1~deb12u1Fixed in 2.50.3+dfsg-1+deb11u1
  2. Upgrade

    Upgrade ubuntu/librsvg to a version that resolves this vulnerability.

    Fixed in 2.56.91Fixed in 2.56.3Fixed in 2.55.3Fixed in 2.54.6Fixed in 2.52.10Fixed in 2.50.8Fixed in 2.48.11Fixed in 2.46.6
  3. Upgrade

    Upgrade ubuntu/librsvg to a version that resolves this vulnerability.

    Fixed in 2.48.9-1ubuntu0.20.04.4
  4. Upgrade

    Upgrade ubuntu/librsvg to a version that resolves this vulnerability.

    Fixed in 2.52.5+dfsg-3ubuntu0.2
  5. Upgrade

    Upgrade ubuntu/librsvg to a version that resolves this vulnerability.

    Fixed in 2.54.5+dfsg-1ubuntu2.1
  6. Upgrade

    Upgrade debian/librsvg to a version that resolves this vulnerability.

    Fixed in 2.44.10-2.1+deb10u3Fixed in 2.50.3+dfsg-1+deb11u1Fixed in 2.54.7+dfsg-1~deb12u1Fixed in 2.54.7+dfsg-2
  7. Upgrade

    Upgrade librsvg to a version that resolves this vulnerability.

    Fixed in 2.56.3Patch CVE-2023-38633

Event History

Jul 22, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
05:15 PM
Description
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 24, 2023
Data Sourced
via Red Hat·03:16 AM
DescriptionSeverityAffected Software
Jan 12, 2024
Data Sourced
via Launchpad·12:22 AM
Description

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2023-38633?

CVE-2023-38633 is a vulnerability in librsvg that allows for arbitrary file read when xinclude href has special characters.

2

How severe is CVE-2023-38633?

CVE-2023-38633 has a severity rating of 5.5/10, which is considered medium.

3

How can I exploit CVE-2023-38633?

CVE-2023-38633 can be exploited by using a directory traversal technique with specially crafted href in an xi:include element.

4

What is the affected software for CVE-2023-38633?

The affected software for CVE-2023-38633 includes versions of librsvg before 2.56.3.

5

How do I fix CVE-2023-38633?

To fix CVE-2023-38633, update to version 2.56.3 or later of librsvg.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203