The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - inkscape: XXE via SVG rasterization (CVE-2012-5656)

  - inkscape: Reads .eps files from /tmp instead of current working directory (CVE-2012-6076)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

inkscape has been updated to fix a XXE (Xml eXternal Entity) attack during rasterization of SVG images. (CVE-2012-5656), where the rendering of malicious SVG images could have connected from inkscape to internal hosts.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Inkscape was updated to fix two security issues :

  - inkscape occasionaly tries to open EPS files from /tmp     (bnc#796306, CVE-2012-6076).

  - inkscape could load XML from external hosts (bnc#794958,     CWE-827, CVE-2012-5656).

inkscape has been updated to fix a XXE (Xml eXternal Entity) attack during rasterization of SVG images. (CVE-2012-5656), where the rendering of malicious SVG images could have connected from inkscape to internal hosts.

inkscape was updated to fix a XXE (Xml eXternal Entity) attack during rasterization of SVG images (CVE-2012-5656), where the rendering of malicious SVG images could have connected from inkscape to internal hosts.

Also inkscape would have loaded .EPS files from untrusted /tmp occasionaly instead from the current directory. (CVE-2012-6076)

It was discoverd that Inkscape incorrectly handled XML external entities in SVG files. If a user were tricked into opening a specially crafted SVG file, Inkscape could possibly include external files in drawings, resulting in information disclosure. (CVE-2012-5656)

It was discovered that Inkscape attempted to open certain files from the /tmp directory instead of the current directory. A local attacker could trick a user into opening a different file than the one that was intended. This issue only applied to Ubuntu 11.10, Ubuntu 12.04 LTS and Ubuntu 12.10. (CVE-2012-6076).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix XXE flaw, man page ownership.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199221	RHEL 6 : inkscape (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
83576	SUSE SLED10 Security Update : inkscape (SUSE-SU-2013:0350-1)	Nessus	SuSE Local Security Checks	low
74889	openSUSE Security Update : inkscape (openSUSE-SU-2013:0294-1)	Nessus	SuSE Local Security Checks	medium
64908	SuSE 10 Security Update : inkscape (ZYPP Patch Number 8471)	Nessus	SuSE Local Security Checks	low
64906	SuSE 11.2 Security Update : inkscape (SAT Patch Number 7380)	Nessus	SuSE Local Security Checks	medium
64375	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : inkscape vulnerabilities (USN-1712-1)	Nessus	Ubuntu Local Security Checks	medium
63390	Fedora 16 : inkscape-0.48.4-1.fc16 (2012-20621)	Nessus	Fedora Local Security Checks	low
63389	Fedora 17 : inkscape-0.48.4-1.fc17 (2012-20620)	Nessus	Fedora Local Security Checks	low
63330	Fedora 18 : inkscape-0.48.4-1.fc18 (2012-20643)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2012-5656

medium

Tenable Plugins

medium

low

medium

low

medium

medium

low

low

low