REDHAT-BUG-2224945: Medium severity centos librsvg2 vulnerability
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3 https://bugzilla.suse.com/showbug.cgi?id=1213502 https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2224945?
The severity of REDHAT-BUG-2224945 is considered to be high due to the potential for file disclosure vulnerabilities.
How do I fix REDHAT-BUG-2224945?
To fix REDHAT-BUG-2224945, update librsvg to version 2.56.3 or later.
What causes the REDHAT-BUG-2224945 vulnerability?
The REDHAT-BUG-2224945 vulnerability is caused by a directory traversal issue in the URL decoder of librsvg.
Who is affected by REDHAT-BUG-2224945?
Users of GNOME librsvg versions prior to 2.56.3 are affected by REDHAT-BUG-2224945.
Can REDHAT-BUG-2224945 be exploited remotely?
Yes, REDHAT-BUG-2224945 can be exploited by remote attackers to disclose files from the local filesystem.