CVE-2012-5656

MEDIUM EPSS 63.2%
Published Jan 18, 201313y ago · Modified Jun 16, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jan 18, 2013 13y ago
Last Modified Jun 16, 2026 2w ago

Description

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
63.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-611

Affected Products 11

VendorProductVersionRange
inkscapeinkscape* <0.48.4
fedoraprojectfedora16any
fedoraprojectfedora17any
fedoraprojectfedora18any
canonicalubuntu_linux10.04any
canonicalubuntu_linux11.10any
canonicalubuntu_linux12.04any
canonicalubuntu_linux12.10any
opensuseopensuse11.4any
opensuseopensuse12.1any
opensuseopensuse12.2any

References 11

  • bazaar.launchpad.net http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931
    Patch
  • lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html
    Mailing List
  • lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html
    Mailing List
  • lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html
    Mailing List
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html
    Mailing List
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html
    Mailing List
  • openwall.com http://www.openwall.com/lists/oss-security/2012/12/20/3
    ExploitMailing List
  • securityfocus.com http://www.securityfocus.com/bid/56965
    Broken LinkThird Party AdvisoryVDB Entry
  • ubuntu.com http://www.ubuntu.com/usn/USN-1712-1
    Third Party Advisory
  • bugs.launchpad.net https://bugs.launchpad.net/inkscape/+bug/1025185
    ExploitIssue Tracking
  • launchpad.net https://launchpad.net/inkscape/+milestone/0.48.4
    Product

Remediation