Skip to content
OpenAdvisories
High ALAS2023-2023-295 1 CVE

Important: librsvg2 security update (Amazon Linux 2023)

Published Aug 17, 2023 · Updated Aug 23, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38633: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 librsvg2 0:2.50.7-1.amzn2023.0.3
Amazon Linux · 2023 librsvg2-debuginfo 0:2.50.7-1.amzn2023.0.3
Amazon Linux · 2023 librsvg2-debugsource 0:2.50.7-1.amzn2023.0.3
Amazon Linux · 2023 librsvg2-devel 0:2.50.7-1.amzn2023.0.3
Amazon Linux · 2023 librsvg2-tools 0:2.50.7-1.amzn2023.0.3
Amazon Linux · 2023 librsvg2-tools-debuginfo 0:2.50.7-1.amzn2023.0.3

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-38633.html