Ubuntu Security Notice 6266-1 - Zac Sims discovered that librsvg incorrectly handled decoding URLs. A remote attacker could possibly use this issue to read arbitrary files by using an include element.
06773e26613c1f6604d2287ee6c54aa9a6a94e09a0c9341148dd41b01d3a1f80
==========================================================================
Ubuntu Security Notice USN-6266-1
August 01, 2023
librsvg vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
librsvg could be made to expose sensitive information.
Software Description:
- librsvg: renderer library for SVG files
Details:
Zac Sims discovered that librsvg incorrectly handled decoding URLs. A
remote attacker could possibly use this issue to read arbitrary files by
using an include element.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.04:
librsvg2-2 2.54.5+dfsg-1ubuntu2.1
Ubuntu 22.04 LTS:
librsvg2-2 2.52.5+dfsg-3ubuntu0.2
Ubuntu 20.04 LTS:
librsvg2-2 2.48.9-1ubuntu0.20.04.4
After a standard system update you need to restart your session to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6266-1
CVE-2023-38633
Package Information:
https://launchpad.net/ubuntu/+source/librsvg/2.54.5+dfsg-1ubuntu2.1
https://launchpad.net/ubuntu/+source/librsvg/2.52.5+dfsg-3ubuntu0.2
https://launchpad.net/ubuntu/+source/librsvg/2.48.9-1ubuntu0.20.04.4