CVE-2012-5656

Published: Jan 18, 2013Modified: Apr 29, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.

Affected (11)

Products: Inkscape: Inkscape · Fedoraproject: Fedora · Canonical: Ubuntu Linux · +1 more

Show all products

Inkscape: Inkscape · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Opensuse: Opensuse

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Inkscape Inkscape	Before 0.48.4

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 16
Fedoraproject Fedora	Version 17
Fedoraproject Fedora	Version 18

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 11.10
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.1
Opensuse Opensuse	Version 12.2

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (22)

http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html

Source: secalert@redhat.com

Mailing List

http://www.openwall.com/lists/oss-security/2012/12/20/3

Source: secalert@redhat.com

ExploitMailing List

http://www.securityfocus.com/bid/56965

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1712-1

Source: secalert@redhat.com

Third Party Advisory

https://bugs.launchpad.net/inkscape/+bug/1025185

Source: secalert@redhat.com

ExploitIssue Tracking

https://launchpad.net/inkscape/+milestone/0.48.4

Source: secalert@redhat.com

Product

http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931