A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0073 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-38633:
    A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has librsvg2 packages installed that are affected by a vulnerability:

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202408-14 (Librsvg: Arbitrary File Read)

    A directory traversal problem in the URL decoder of librsvg could be used by local or remote attackers to     disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the librsvg2-2.50.7-2.el9 build changelog.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href='.?../../../../../../../../../../etc/passwd' in an xi:include element. (CVE-2023-38633)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5081 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5081 advisory.

    [2.50.7-1.el9_2.1]
    - Fix CVE-2023-38633 (#2224947)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5081 advisory.

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

    Security Fix(es):

    * librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4809 advisory.

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

    Security Fix(es):

    * librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5484 advisory.

    Zac Sims discovered a directory traversal in the URL decoder of librsvg, a SAX-based renderer library for     SVG files, which could result in read of arbitrary files when processing a specially crafted SVG file with     an XInclude element. For the oldstable distribution (bullseye), this problem has been fixed in version     2.50.3+dfsg-1+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version     2.54.7+dfsg-1~deb12u1. We recommend that you upgrade your librsvg packages. For the detailed security     status of librsvg please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/librsvg

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-295 advisory.

    A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0873c38acd advisory.

    librsvg 2.54.6 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3208-1 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-fc79ee273d advisory.

    librsvg 2.56.3 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.
    - Fix cascade for symbol elements being referenced from use elements.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6266-1 advisory.

    Zac Sims discovered that librsvg incorrectly handled decoding URLs. A remote attacker could possibly use     this issue to read arbitrary files by using an include element.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3021-1 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276245	TencentOS Server 4: librsvg2 (TSSA-2025:0073)	Nessus	Tencent Local Security Checks	medium
242793	NewStart CGSL MAIN 7.02 : librsvg2 Vulnerability (NS-SA-2025-0127)	Nessus	NewStart CGSL Local Security Checks	medium
226277	Linux Distros Unpatched Vulnerability : CVE-2023-38633	Nessus	Misc.	medium
205282	GLSA-202408-14 : Librsvg: Arbitrary File Read	Nessus	Gentoo Local Security Checks	medium
191377	CentOS 9 : librsvg2-2.50.7-2.el9	Nessus	CentOS Local Security Checks	medium
188223	EulerOS 2.0 SP11 : librsvg2 (EulerOS-SA-2023-3012)	Nessus	Huawei Local Security Checks	medium
188209	EulerOS 2.0 SP11 : librsvg2 (EulerOS-SA-2023-3035)	Nessus	Huawei Local Security Checks	medium
181431	AlmaLinux 9 : librsvg2 (ALSA-2023:5081)	Nessus	Alma Linux Local Security Checks	medium
181330	Oracle Linux 9 : librsvg2 (ELSA-2023-5081)	Nessus	Oracle Linux Local Security Checks	medium
181287	RHEL 9 : librsvg2 (RHSA-2023:5081)	Nessus	Red Hat Local Security Checks	medium
180246	RHEL 9 : librsvg2 (RHSA-2023:4809)	Nessus	Red Hat Local Security Checks	medium
180206	Debian DSA-5484-1 : librsvg - security update	Nessus	Debian Local Security Checks	medium
180110	Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2023-295)	Nessus	Amazon Linux Local Security Checks	medium
179909	Fedora 37 : librsvg2 (2023-0873c38acd)	Nessus	Fedora Local Security Checks	medium
179430	SUSE SLES15 / openSUSE 15 Security Update : librsvg (SUSE-SU-2023:3208-1)	Nessus	SuSE Local Security Checks	medium
179342	Fedora 38 : librsvg2 (2023-fc79ee273d)	Nessus	Fedora Local Security Checks	medium
179146	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : librsvg vulnerability (USN-6266-1)	Nessus	Ubuntu Local Security Checks	medium
179030	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : librsvg (SUSE-SU-2023:3021-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-38633

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium