A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-librsvg2alma-upgrade-librsvg2-develalma-upgrade-librsvg2-tools | Sep 15, 2023 | Jul 22, 2023 | |
| Alpine Linux | alpine-linux-upgrade-librsvg | Aug 22, 2024 | Jul 22, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-librsvg2amazon-linux-2023-upgrade-librsvg2-debuginfoamazon-linux-2023-upgrade-librsvg2-debugsourceamazon-linux-2023-upgrade-librsvg2-develamazon-linux-2023-upgrade-librsvg2-toolsamazon-linux-2023-upgrade-librsvg2-tools-debuginfo | Feb 17, 2025 | Jul 22, 2023 | |
| Centos_linux | — | centos-upgrade-librsvg2centos-upgrade-librsvg2-debuginfocentos-upgrade-librsvg2-debugsourcecentos-upgrade-librsvg2-develcentos-upgrade-librsvg2-toolscentos-upgrade-librsvg2-tools-debuginfo | Sep 13, 2023 | Jul 22, 2023 |
| Debian | debian-upgrade-librsvg | Aug 29, 2023 | Jul 22, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-gnome-base-librsvg | Aug 12, 2024 | Jul 22, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-librsvg2huawei-euleros-2_0_sp10-upgrade-librsvg2-help | Jan 15, 2026 | Jan 13, 2026 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-librsvg2huawei-euleros-2_0_sp11-upgrade-librsvg2-help | Jan 10, 2024 | Jul 22, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-librsvg2oracle-linux-upgrade-librsvg2-develoracle-linux-upgrade-librsvg2-tools | Sep 13, 2023 | Jul 22, 2023 |
| Redhat_linux | redhat-upgrade-librsvg2redhat-upgrade-librsvg2-debuginforedhat-upgrade-librsvg2-debugsourceredhat-upgrade-librsvg2-develredhat-upgrade-librsvg2-toolsredhat-upgrade-librsvg2-tools-debuginfo | Aug 30, 2023 | Jul 22, 2023 | |
| Suse | — | suse-upgrade-gdk-pixbuf-loader-rsvgsuse-upgrade-gdk-pixbuf-loader-rsvg-32bitsuse-upgrade-librsvg-2-2suse-upgrade-librsvg-2-2-32bitsuse-upgrade-librsvg-develsuse-upgrade-rsvg-convertsuse-upgrade-rsvg-thumbnailersuse-upgrade-typelib-1_0-rsvg-2_0 | Jul 31, 2023 | Jul 22, 2023 |
| Ubuntu | ubuntu-upgrade-librsvg2-2 | Aug 2, 2023 | Jul 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub