A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librsvg2-toolsUpgrade librsvg2Upgrade librsvg2-devel | Sep 15, 2023 | Jul 22, 2023 |
| Alpine Linux | — | Upgrade librsvg | Aug 22, 2024 | Jul 22, 2023 |
| Amazon_linux_2023 | — | Upgrade librsvg2-develUpgrade librsvg2-debuginfoUpgrade librsvg2Upgrade librsvg2-toolsUpgrade librsvg2-debugsourceUpgrade librsvg2-tools-debuginfo | Feb 17, 2025 | Jul 22, 2023 |
| Centos_linux | — | Upgrade librsvg2-tools-debuginfoUpgrade librsvg2Upgrade librsvg2-debuginfoUpgrade librsvg2-toolsUpgrade librsvg2-debugsourceUpgrade librsvg2-devel | Sep 13, 2023 | Jul 22, 2023 |
| Debian | — | Upgrade librsvg | Aug 29, 2023 | Jul 22, 2023 |
| Gentoo Linux | — | Upgrade gnome-base/librsvg. | Aug 12, 2024 | Jul 22, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade librsvg2-helpUpgrade librsvg2 | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade librsvg2-helpUpgrade librsvg2 | Jan 10, 2024 | Jul 22, 2023 |
| Oracle_linux | — | Upgrade librsvg2-develUpgrade librsvg2Upgrade librsvg2-tools | Sep 13, 2023 | Jul 22, 2023 |
| Redhat_linux | — | Upgrade librsvg2-tools-debuginfoUpgrade librsvg2-debuginfoUpgrade librsvg2-develUpgrade librsvg2Upgrade librsvg2-toolsUpgrade librsvg2-debugsourceNo solution exists | Aug 30, 2023 | Jul 22, 2023 |
| Suse | — | Upgrade gdk-pixbuf-loader-rsvgUpgrade librsvg-develUpgrade rsvg-convertUpgrade rsvg-thumbnailerUpgrade librsvg-2-2Upgrade librsvg-2-2-32bitUpgrade gdk-pixbuf-loader-rsvg-32bitUpgrade typelib-1_0-Rsvg-2_0 | Jul 31, 2023 | Jul 22, 2023 |
| Ubuntu | — | Upgrade librsvg2-2 | Aug 2, 2023 | Jul 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub