Summary
Zac Sims discovered that librsvg incorrectly handled decoding URLs. A
remote attacker could possibly use this issue to read arbitrary files by
using an include element.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | librsvg | 2.48.9-1ubuntu0.20.04.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | librsvg | 2.52.5+dfsg-3ubuntu0.2 |
Vulnerabilities 1
-
Unscored —
A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to…
References
-
report
https://ubuntu.com/security/CVE-2023-38633