According to the versions of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href='.?../../../../../../../../../../etc/passwd' in an xi:include element. (CVE-2023-38633)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202408-14 (Librsvg: Arbitrary File Read)

    A directory traversal problem in the URL decoder of librsvg could be used by local or remote attackers to     disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5484 advisory.

    Zac Sims discovered a directory traversal in the URL decoder of librsvg, a SAX-based renderer library for     SVG files, which could result in read of arbitrary files when processing a specially crafted SVG file with     an XInclude element. For the oldstable distribution (bullseye), this problem has been fixed in version     2.50.3+dfsg-1+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version     2.54.7+dfsg-1~deb12u1. We recommend that you upgrade your librsvg packages. For the detailed security     status of librsvg please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/librsvg

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3021-1 advisory.

    librsvg was updated to version 2.52.10:

    - CVE-2023-38633: Fixed directory traversal in URI decoder (bsc#1213502).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-fc79ee273d advisory.

    librsvg 2.56.3 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.
    - Fix cascade for symbol elements being referenced from use elements.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0073 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-38633:
    A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5081 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0873c38acd advisory.

    librsvg 2.54.6 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
188223	EulerOS 2.0 SP11 : librsvg2 (EulerOS-SA-2023-3012)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
205282	GLSA-202408-14 : Librsvg: Arbitrary File Read	Nessus	Gentoo Local Security Checks	2024/8/9	2024/8/9	medium
180206	Debian DSA-5484-1 : librsvg - security update	Nessus	Debian Local Security Checks	2023/8/27	2025/1/24	medium
179030	openSUSE 15: gdk-pixbuf-loader-rsvg / gdk-pixbuf-loader-rsvg-32bit / librsvg-2-2 / etc (SUSE-SU-2023:3021-1)	Nessus	SuSE Local Security Checks	2023/7/29	2026/6/25	medium
179342	Fedora 38 : librsvg2 (2023-fc79ee273d)	Nessus	Fedora Local Security Checks	2023/8/4	2024/11/14	medium
276245	TencentOS Server 4: librsvg2 (TSSA-2025:0073)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
226277	Linux Distros Unpatched Vulnerability : CVE-2023-38633	Nessus	Misc.	2025/3/5	2026/9/2	medium
181431	AlmaLinux 9 : librsvg2 (ALSA-2023:5081)	Nessus	Alma Linux Local Security Checks	2023/9/14	2023/11/8	medium
179909	Fedora 37 : librsvg2 (2023-0873c38acd)	Nessus	Fedora Local Security Checks	2023/8/17	2024/11/14	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium