Bug 918100 (CVE-2023-38633)

Summary:	<gnome-base/librsvg-2.56.3: arbitrary file read via crafted xinclude href
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	gnome
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://gitlab.gnome.org/GNOME/librsvg/-/issues/996
Whiteboard:	A3 [glsa+]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-11-23 18:34:40 UTC

CVE-2023-38633:

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element.

Fixed in 2.56.3.

Comment 1 Larry the Git Cow gentoo-dev

2024-08-09 06:49:37 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=ee393cbbcbbe8ef3e34fe144807538d883d06f65

commit ee393cbbcbbe8ef3e34fe144807538d883d06f65
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-08-09 06:49:19 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-08-09 06:49:35 +0000

    [ GLSA 202408-14 ] Librsvg: Arbitrary File Read
    
    Bug: https://bugs.gentoo.org/918100
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202408-14.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)