ALT-PU-2023-8841-1

BDU:2023-05427

MEDIUM5.5

Уязвимость механизма объединения XML-документов XInclude библиотеки отрисовки векторной графики librsvg, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2023-09-11Modified: 2024-04-27

CVSS 3.xMEDIUM 5.5

CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0MEDIUM 4.6

CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:N/A:N

References

CVE-2023-38633

CVE-2023-38633

MEDIUM5.5

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

Published: 2023-07-22Modified: 2024-11-21

CVSS 3.xMEDIUM 5.5

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

http://seclists.org/fulldisclosure/2023/Jul/43
http://www.openwall.com/lists/oss-security/2023/07/27/1
http://www.openwall.com/lists/oss-security/2023/09/06/10
https://bugzilla.suse.com/show_bug.cgi?id=1213502
https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
https://news.ycombinator.com/item?id=37415799
https://security.netapp.com/advisory/ntap-20230831-0011/
https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
https://www.debian.org/security/2023/dsa-5484
http://seclists.org/fulldisclosure/2023/Jul/43
http://www.openwall.com/lists/oss-security/2023/07/27/1
http://www.openwall.com/lists/oss-security/2023/09/06/10
https://bugzilla.suse.com/show_bug.cgi?id=1213502
https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/
https://news.ycombinator.com/item?id=37415799
https://security.netapp.com/advisory/ntap-20230831-0011/
https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/
https://www.debian.org/security/2023/dsa-5484

Package update librsvg in branch sisyphus

Closed issues (2)

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.