The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the librsvg2-2.50.7-2.el9 build changelog.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6266-1 advisory.

    Zac Sims discovered that librsvg incorrectly handled decoding URLs. A remote attacker could possibly use     this issue to read arbitrary files by using an include element.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-295 advisory.

    A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has librsvg2 packages installed that are affected by a vulnerability:

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6396:01 advisory.

    * librsvg: Arbitrary file read when xinclude href has special characters (CVE-2023-38633)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0873c38acd advisory.

    librsvg 2.54.6 release, fixing CVE-2023-38633:

    - Fix arbitrary file read when href has special characters.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5081 advisory.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
191377	CentOS 9 : librsvg2-2.50.7-2.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
179146	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : librsvg vulnerability (USN-6266-1)	Nessus	Ubuntu Local Security Checks	2023/8/1	2024/8/28	medium
180110	Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2023-295)	Nessus	Amazon Linux Local Security Checks	2023/8/24	2024/12/11	medium
242793	NewStart CGSL MAIN 7.02 : librsvg2 Vulnerability (NS-SA-2025-0127)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
293465	MiracleLinux 9 : librsvg2-2.50.7-1.el9.1 (AXSA:2023-6396:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
179909	Fedora 37 : librsvg2 (2023-0873c38acd)	Nessus	Fedora Local Security Checks	2023/8/17	2024/11/14	medium
181431	AlmaLinux 9 : librsvg2 (ALSA-2023:5081)	Nessus	Alma Linux Local Security Checks	2023/9/14	2023/11/8	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium