{"schemaVersion":3,"id":"CVE-2023-38633","aliases":["MGASA-2023-0259","SUSE-SU-2023:3021-1","SUSE-SU-2023:3208-1","RHSA-2023:4809","RHSA-2023:5081","UBUNTU-CVE-2023-38633","USN-6266-1","DEBIAN-CVE-2023-38633","DSA-5484-1"],"status":"published","duplicateOf":null,"title":null,"description":"A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=\".?../../../../../../../../../../etc/passwd\" in an xi:include element.","dates":{"published":"2023-07-22T00:00:00.000Z","modified":"2024-08-02T17:46:56.600Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02325,"percentile":0.83257,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.02325},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02325,"percentile":0.83257}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02325,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02325,"percentile":0.83257}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_C52645F6D65796E9","name":"Exploit Reference (gitlab.gnome.org)","source":"reference","url":"https://gitlab.gnome.org/GNOME/librsvg/-/issues/996","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_AFC6770B7A307A82","name":"Exploit Reference (openwall.com)","source":"reference","url":"http://www.openwall.com/lists/oss-security/2023/07/27/1","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_E16F0E8CD180491F","name":"Exploit Reference (canva.dev)","source":"reference","url":"https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"debian","product":"librsvg","name":"librsvg","label":"librsvg","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/librsvg","purlType":"deb","versions":[{"text":"< 2.54.7+dfsg-1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.50.3+dfsg-1+deb11u1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.54.7+dfsg-1~deb12u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.54.7+dfsg-1 | < 2.50.3+dfsg-1+deb11u1 | < 2.54.7+dfsg-1~deb12u1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"librsvg","name":"librsvg","label":"librsvg","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/librsvg","purlType":"deb","versions":[{"text":"< 2.48.9-1ubuntu0.20.04.4","noFixRecorded":false,"fixedIn":null},{"text":"< 2.52.5+dfsg-3ubuntu0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.48.9-1ubuntu0.20.04.4 | < 2.52.5+dfsg-3ubuntu0.2","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.0","noFixRecorded":false,"fixedIn":null},{"text":"12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.0 | 12.0","eol":{"isEol":true,"eolDate":"2026-08-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11","label":"11 (Bullseye)","eolFrom":"2026-08-31T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"11.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"37","noFixRecorded":false,"fixedIn":null},{"text":"38","noFixRecorded":false,"fixedIn":null}],"versionsText":"37 | 38","eol":{"isEol":true,"eolDate":"2023-12-05T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"37","label":"37","eolFrom":"2023-12-05T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"gnome","product":"librsvg","name":"librsvg","label":"librsvg","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.42.3, < 2.46.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.48.0, < 2.48.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.50.0, < 2.50.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.52.0, < 2.52.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.54.0, < 2.54.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.55.0, < 2.55.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.56.0, < 2.56.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.42.3, < 2.46.6 | ≥ 2.48.0, < 2.48.11 | ≥ 2.50.0, < 2.50.8 | ≥ 2.52.0, < 2.52.10 | ≥ 2.54.0, < 2.54.6 | ≥ 2.55.0, < 2.55.3 | ≥ 2.56.0, < 2.56.3","eol":null,"hubHref":"/vendor/gnome/librsvg"},{"vendor":"mageia","product":"librsvg","name":"librsvg","label":"librsvg","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/librsvg","purlType":"rpm","versions":[{"text":"< 2.50.3-1.2.mga8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.50.3-1.2.mga8","eol":null,"hubHref":null},{"vendor":"mageia","product":"librsvg","name":"librsvg","label":"librsvg","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/librsvg","purlType":"rpm","versions":[{"text":"< 2.56.0-1.1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.56.0-1.1.mga9","eol":null,"hubHref":null},{"vendor":"opensuse","product":"librsvg&distro=openSUSE Leap 15.4","name":"librsvg","label":"librsvg&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/librsvg&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"librsvg&distro=openSUSE Leap 15.5","name":"librsvg","label":"librsvg&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/librsvg&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"librsvg&distro=openSUSE Leap Micro 5.3","name":"librsvg","label":"librsvg&distro=openSUSE Leap Micro 5.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/librsvg&distro=openSUSE Leap Micro 5.3","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"librsvg&distro=openSUSE Leap Micro 5.4","name":"librsvg","label":"librsvg&distro=openSUSE Leap Micro 5.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/librsvg&distro=openSUSE Leap Micro 5.4","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"librsvg2","name":"librsvg2","label":"librsvg2","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/librsvg2","purlType":"rpm","versions":[{"text":"< 0:2.50.7-1.el9_0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:2.50.7-1.el9_2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.50.7-1.el9_0.1 | < 0:2.50.7-1.el9_2.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"librsvg2-debuginfo","name":"librsvg2-debuginfo","label":"librsvg2-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/librsvg2-debuginfo","purlType":"rpm","versions":[{"text":"< 0:2.50.7-1.el9_0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:2.50.7-1.el9_2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.50.7-1.el9_0.1 | < 0:2.50.7-1.el9_2.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"librsvg2-debugsource","name":"librsvg2-debugsource","label":"librsvg2-debugsource","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/librsvg2-debugsource","purlType":"rpm","versions":[{"text":"< 0:2.50.7-1.el9_0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:2.50.7-1.el9_2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.50.7-1.el9_0.1 | < 0:2.50.7-1.el9_2.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"librsvg2-devel","name":"librsvg2-devel","label":"librsvg2-devel","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/librsvg2-devel","purlType":"rpm","versions":[{"text":"< 0:2.50.7-1.el9_0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:2.50.7-1.el9_2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.50.7-1.el9_0.1 | < 0:2.50.7-1.el9_2.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"librsvg2-tools","name":"librsvg2-tools","label":"librsvg2-tools","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/librsvg2-tools","purlType":"rpm","versions":[{"text":"< 0:2.50.7-1.el9_0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:2.50.7-1.el9_2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.50.7-1.el9_0.1 | < 0:2.50.7-1.el9_2.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"librsvg2-tools-debuginfo","name":"librsvg2-tools-debuginfo","label":"librsvg2-tools-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/librsvg2-tools-debuginfo","purlType":"rpm","versions":[{"text":"< 0:2.50.7-1.el9_0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:2.50.7-1.el9_2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.50.7-1.el9_0.1 | < 0:2.50.7-1.el9_2.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Enterprise Storage 7","name":"librsvg","label":"librsvg&distro=SUSE Enterprise Storage 7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Enterprise Storage 7","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Enterprise Storage 7.1","name":"librsvg","label":"librsvg&distro=SUSE Enterprise Storage 7.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Enterprise Storage 7.1","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Micro 5.2","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Micro 5.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Micro 5.2","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Micro 5.3","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Micro 5.3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Micro 5.3","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Micro 5.4","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Micro 5.4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Micro 5.4","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5","purlType":"rpm","versions":[{"text":"< 2.52.10-150400.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.10-150400.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Server 15 SP2-LTSS","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Server 15 SP2-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Server 15 SP2-LTSS","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Server 15 SP3-LTSS","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","name":"librsvg","label":"librsvg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Manager Proxy 4.2","name":"librsvg","label":"librsvg&distro=SUSE Manager Proxy 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Manager Proxy 4.2","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"librsvg&distro=SUSE Manager Server 4.2","name":"librsvg","label":"librsvg&distro=SUSE Manager Server 4.2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/librsvg&distro=SUSE Manager Server 4.2","purlType":"rpm","versions":[{"text":"< 2.46.7-150200.3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.7-150200.3.9.1","eol":null,"hubHref":null}],"affectedCount":36,"eol":{"hasEol":true,"count":2},"references":[{"url":"https://gitlab.gnome.org/GNOME/librsvg/-/issues/996","label":"gitlab.gnome.org/GNOME/librsvg/-/issues/996","hostname":"gitlab.gnome.org","tags":["REPORT","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1213502","label":"bugzilla.suse.com/show_bug.cgi?id=1213502","hostname":"bugzilla.suse.com","tags":["REPORT","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3","label":"gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3","hostname":"gitlab.gnome.org","tags":["Release Notes"]},{"url":"http://seclists.org/fulldisclosure/2023/Jul/43","label":"seclists.org/fulldisclosure/2023/Jul/43","hostname":"seclists.org","tags":["Mailing List","Not Applicable","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/07/27/1","label":"www.openwall.com/lists/oss-security/2023/07/27/1","hostname":"www.openwall.com","tags":["Mailing List","Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","Third Party Advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5484","label":"www.debian.org/security/2023/dsa-5484","hostname":"www.debian.org","tags":["Vendor Advisory","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230831-0011/","label":"security.netapp.com/advisory/ntap-20230831-0011/","hostname":"security.netapp.com","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/06/10","label":"www.openwall.com/lists/oss-security/2023/09/06/10","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/","label":"www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/","hostname":"www.canva.dev","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=37415799","label":"news.ycombinator.com/item?id=37415799","hostname":"news.ycombinator.com","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0259.html","label":"advisories.mageia.org/MGASA-2023-0259.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32210","label":"bugs.mageia.org/show_bug.cgi?id=32210","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.openwall.com/lists/oss-security/2023/07/27/1","label":"www.openwall.com/lists/oss-security/2023/07/27/1","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38633","label":"security-tracker.debian.org/tracker/CVE-2023-38633","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233021-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20233021-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1213502","label":"bugzilla.suse.com/1213502","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38633","label":"www.suse.com/security/cve/CVE-2023-38633","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233208-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20233208-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4809","label":"access.redhat.com/errata/RHSA-2023:4809","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224945","label":"bugzilla.redhat.com/show_bug.cgi?id=2224945","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4809.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4809.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38633","label":"access.redhat.com/security/cve/CVE-2023-38633","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38633","label":"www.cve.org/CVERecord?id=CVE-2023-38633","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38633","label":"nvd.nist.gov/vuln/detail/CVE-2023-38633","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5081","label":"access.redhat.com/errata/RHSA-2023:5081","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5081.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5081.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-38633","label":"ubuntu.com/security/CVE-2023-38633","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://marc.info/?i=73b96607-5080-939c-d354-33da849d195d@oracle.com","label":"marc.info?i=73b96607-5080-939c-d354-33da849d195d@oracle.com","hostname":"marc.info","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-6266-1","label":"ubuntu.com/security/notices/USN-6266-1","hostname":"ubuntu.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-07-22T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T17:46:56.600Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T16:59:16.121Z","stale":false,"partial":false}}