REDHAT-BUG-2224945
First published: Mon Jul 24 2023(Updated: )
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. <a href="https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3">https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3</a> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1213502">https://bugzilla.suse.com/show_bug.cgi?id=1213502</a> <a href="https://gitlab.gnome.org/GNOME/librsvg/-/issues/996">https://gitlab.gnome.org/GNOME/librsvg/-/issues/996</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CentOS Librsvg2 | <2.56.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
- https://bugzilla.suse.com/show_bug.cgi?id=1213502
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
- https://gitlab.gnome.org/GNOME/librsvg/-/issues/996#note_1806622
- https://access.redhat.com/errata/RHSA-2023:4809
- https://access.redhat.com/errata/RHSA-2023:5081
- https://bugzilla.redhat.com/show_bug.cgi?id=2224945
Frequently Asked Questions
What is the severity of REDHAT-BUG-2224945?
The severity of REDHAT-BUG-2224945 is considered to be high due to the potential for file disclosure vulnerabilities.
How do I fix REDHAT-BUG-2224945?
To fix REDHAT-BUG-2224945, update librsvg to version 2.56.3 or later.
What causes the REDHAT-BUG-2224945 vulnerability?
The REDHAT-BUG-2224945 vulnerability is caused by a directory traversal issue in the URL decoder of librsvg.
Who is affected by REDHAT-BUG-2224945?
Users of GNOME librsvg versions prior to 2.56.3 are affected by REDHAT-BUG-2224945.
Can REDHAT-BUG-2224945 be exploited remotely?
Yes, REDHAT-BUG-2224945 can be exploited by remote attackers to disclose files from the local filesystem.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-38633
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnome
- canonical/centos librsvg2