CVE-2012-5656

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
VendorProductVersion
inkscapeinkscape
𝑥
< 0.48.4
canonicalubuntu_linux
10.04
canonicalubuntu_linux
11.10
canonicalubuntu_linux
12.04
canonicalubuntu_linux
12.10
opensuseopensuse
11.4
opensuseopensuse
12.1
opensuseopensuse
12.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
inkscape
bullseye
1.0.2-4
fixed
squeeze
no-dsa
bookworm
1.2.2-2
fixed
sid
1.2.2-4
fixed
trixie
1.2.2-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
inkscape
quantal
Fixed 0.48.3.1-1ubuntu6.1
released
precise
Fixed 0.48.3.1-1ubuntu1.1
released
oneiric
Fixed 0.48.2-0ubuntu1.1
released
lucid
Fixed 0.47.0-2ubuntu2.1
released
hardy
ignored
Common Weakness Enumeration
References
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html
http://www.openwall.com/lists/oss-security/2012/12/20/3
http://www.securityfocus.com/bid/56965
http://www.ubuntu.com/usn/USN-1712-1
https://bugs.launchpad.net/inkscape/+bug/1025185
https://launchpad.net/inkscape/+milestone/0.48.4
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html
http://www.openwall.com/lists/oss-security/2012/12/20/3
http://www.securityfocus.com/bid/56965
http://www.ubuntu.com/usn/USN-1712-1
https://bugs.launchpad.net/inkscape/+bug/1025185
https://launchpad.net/inkscape/+milestone/0.48.4