CVE-2012-5656 The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
MediumCVSS 5.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/inkscape(Debian:12) | < 0.48.3.1-1.2 | 0.48.3.1-1.2 |
| debian/inkscape(Debian:13) | < 0.48.3.1-1.2 | 0.48.3.1-1.2 |
| debian/inkscape(Debian:14) | < 0.48.3.1-1.2 | 0.48.3.1-1.2 |
| inkscape | < 0.48.4 | 0.48.4 |
| fedoraproject fedora | = 16 | No fix listed |
| fedoraproject fedora | = 17 | No fix listed |
| fedoraproject fedora | = 18 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.1 | No fix listed |
| opensuse | = 12.2 | No fix listed |
References
- Debian Security Tracker CVE-2012-5656 vendor-advisory
- bazaar.launchpad.net patch
- FEDORA-2012-20643 mailing-list vendor-advisory
- FEDORA-2012-20620 mailing-list vendor-advisory
- FEDORA-2012-20621 mailing-list vendor-advisory
- openSUSE-SU-2013:0294 mailing-list vendor-advisory
- openSUSE-SU-2013:0297 mailing-list vendor-advisory
- [oss-security] 20121219 Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images exploit mailing-list
- 56965 broken-link third-party-advisory vdb-entry
- USN-1712-1 third-party-advisory vendor-advisory
- bugs.launchpad.net exploit issue-tracking
- launchpad.net product
- bugs.debian.org issue-tracking