A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

The remote host is affected by the vulnerability described in GLSA-202408-14 (Librsvg: Arbitrary File Read)

    A directory traversal problem in the URL decoder of librsvg could be used by local or remote attackers to     disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the librsvg2-2.50.7-2.el9 build changelog.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href='.?../../../../../../../../../../etc/passwd' in an xi:include element. (CVE-2023-38633)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5081 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5081 advisory.

    [2.50.7-1.el9_2.1]
    - Fix CVE-2023-38633 (#2224947)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5081 advisory.

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

    Security Fix(es):

    * librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4809 advisory.

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

    Security Fix(es):

    * librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5484 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-295 advisory.

    A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0873c38acd advisory.

    librsvg 2.54.6 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3208-1 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-fc79ee273d advisory.

    librsvg 2.56.3 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.
    - Fix cascade for symbol elements being referenced from use elements.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6266-1 advisory.

    Zac Sims discovered that librsvg incorrectly handled decoding URLs. A remote attacker could possibly use     this issue to read arbitrary files by using an include element.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3021-1 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205282	GLSA-202408-14 : Librsvg: Arbitrary File Read	Nessus	Gentoo Local Security Checks	medium
200003	RHEL 8 : librsvg2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196598	RHEL 6 : librsvg (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196540	RHEL 7 : librsvg (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191377	CentOS 9 : librsvg2-2.50.7-2.el9	Nessus	CentOS Local Security Checks	medium
188223	EulerOS 2.0 SP11 : librsvg2 (EulerOS-SA-2023-3012)	Nessus	Huawei Local Security Checks	medium
188209	EulerOS 2.0 SP11 : librsvg2 (EulerOS-SA-2023-3035)	Nessus	Huawei Local Security Checks	medium
181431	AlmaLinux 9 : librsvg2 (ALSA-2023:5081)	Nessus	Alma Linux Local Security Checks	medium
181330	Oracle Linux 9 : librsvg2 (ELSA-2023-5081)	Nessus	Oracle Linux Local Security Checks	medium
181287	RHEL 9 : librsvg2 (RHSA-2023:5081)	Nessus	Red Hat Local Security Checks	medium
180246	RHEL 9 : librsvg2 (RHSA-2023:4809)	Nessus	Red Hat Local Security Checks	medium
180206	Debian DSA-5484-1 : librsvg - security update	Nessus	Debian Local Security Checks	medium
180110	Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2023-295)	Nessus	Amazon Linux Local Security Checks	medium
179909	Fedora 37 : librsvg2 (2023-0873c38acd)	Nessus	Fedora Local Security Checks	medium
179430	SUSE SLES15 / openSUSE 15 Security Update : librsvg (SUSE-SU-2023:3208-1)	Nessus	SuSE Local Security Checks	medium
179342	Fedora 38 : librsvg2 (2023-fc79ee273d)	Nessus	Fedora Local Security Checks	medium
179146	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : librsvg vulnerability (USN-6266-1)	Nessus	Ubuntu Local Security Checks	medium
179030	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : librsvg (SUSE-SU-2023:3021-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-38633

medium

Tenable Plugins

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium