5.5

CVE-2012-5656

Exploit
The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Inkscape ≫ Inkscape Version < 0.48.4
Fedoraproject ≫ Fedora Version 16
Fedoraproject ≫ Fedora Version 17
Fedoraproject ≫ Fedora Version 18
Canonical ≫ Ubuntu Linux Version 10.04 SwEdition -
Canonical ≫ Ubuntu Linux Version 11.10
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition -
Canonical ≫ Ubuntu Linux Version 12.10
Opensuse ≫ Opensuse Version 11.4
Opensuse ≫ Opensuse Version 12.1
Opensuse ≫ Opensuse Version 12.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.629
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931
Patch
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html
Mailing List
http://www.openwall.com/lists/oss-security/2012/12/20/3
Exploit
Mailing List
http://www.securityfocus.com/bid/56965
Third Party Advisory
Broken Link
VDB Entry
http://www.ubuntu.com/usn/USN-1712-1
Third Party Advisory
https://bugs.launchpad.net/inkscape/+bug/1025185
Exploit
Issue Tracking
https://launchpad.net/inkscape/+milestone/0.48.4
Product