Updated librsvg packages fix security vulnerability

2023-09-1116:07:54

Gentoo Foundation

advisories.mageia.org

librsvg

security vulnerability

directory traversal

url decoder

cve-2023-38633

unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

52.4%

JSON

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=“.?../…/…/…/…/…/…/…/…/…/etc/passwd” in an xi:include element. (CVE-2023-38633)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchlibrsvg< 2.50.3-1.2librsvg-2.50.3-1.2.mga8
Mageia9noarchlibrsvg< 2.56.0-1.1librsvg-2.56.0-1.1.mga9