[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 18 Dec 2012 20:53:55 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
Subject: Re: CVE request: Inkscape fixes a XXE vulnerability
during rasterization of SVG images
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/18/2012 08:44 PM, Kurt Seifried wrote:
> On 12/17/2012 01:27 PM, Nicolas Grégoire wrote:
>
>> Inkscape is vulnerable to XXE attacks during
>> rasterization/export of SVG images:
>> https://bugs.launchpad.net/inkscape/+bug/1025185
>
>> Impact: The impact of this vulnerability range form denial of
>> service to file disclosure. Under Windows, it can also be used
>> to steal LM/NTLM hashes.
>
>> PoC: During rasterization, entities declared in the DTD are
>> dereferenced and the content of the target file is included in
>> the output. Command-line used: "inkscape -e xxe-inkscape.png
>> xxe.svg" (PoC files are attached to the ticket)
>
>> References: CWE-827: Improper Control of Document Type Definition
>> http://cwe.mitre.org/data/definitions/827.html
>
>> Regards, Nicolas Grégoire
>
> This already has a CVE reference in the page:
>
> CVE References
>
> 2012-1102
To clarify that CVE was assigned to
http://seclists.org/oss-sec/2012/q1/549
http://seclists.org/oss-sec/2012/q1/549
so this is probably an error, someone needs to tidy that bug up and
post links to the source/etc so I can see whats going on.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQ0TpTAAoJEBYNRVNeJnmToVkQAL15KAplZyCcwZFZR2PqVr0V
ZbTvQXo93A3FuAlVDZ6FQQJSMU1E5EMpuD80816JLuUgFe1he/VwUoCtUknPdz5n
cgXNCAHAtbEt54bCcRKoVCeFHTnYP0MzA2PDOoRFuRgkUoUwFv6ilL5dcZD8pehq
ZwEWGVE/IDPJ+yFUma+FwtSP0olxoH6ZOP79RPgGoaPrCDfsLRjloKRKX4IUXSHy
aN5wGNVd9RfCCdtjwb8Qd0DakXwqJ0B0spFDK6ZhbtJl7IxdQqEiIndJ6+EhJRQh
A9njFDUjtIUM5jqUe7/Lb2Hzi5cno120dBKxvU/PLk0D7ZSErfI2ZneoxIIIdk42
+kNQ1qT8/08QsnicVlqP9RpUiW9fqx4ndzazNUjCcTyegnjyYNm2VQlOC0quEDyo
DzY2l2PED+A4HZ+gQW0uUcMWuDAaH7o2ti6CGUPgd5IPBYbBJpXBRZmw26QSD71M
xs50rPHiJhuJiw8s6q7M/sq/rf7ixe/AtJ5bfYntzD9pCaxkG7Q/FZytEXjIwiGb
+mqN6q52Gnc6R+neY22la/xwwRnRjYCDIUz/2r4Xt9EV1I5XbS9Zn24DDLE7YFJw
KT1hWAa8GqvmUgv5FjB20M9AANyi7wxUlzdnKsiL3WOJdVpApE2cDpBC41PH9WDZ
EN02SxWlecA1X7CgMGpc
=Bzwi
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
