Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 18 Dec 2012 20:53:55 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr>
Subject: Re: CVE request: Inkscape fixes a XXE vulnerability
 during rasterization of SVG images

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/18/2012 08:44 PM, Kurt Seifried wrote:
> On 12/17/2012 01:27 PM, Nicolas Grégoire wrote:
> 
>> Inkscape is vulnerable to XXE attacks during
>> rasterization/export of SVG images:
>> https://bugs.launchpad.net/inkscape/+bug/1025185
> 
>> Impact: The impact of this vulnerability range form denial of 
>> service to file disclosure. Under Windows, it can also be used
>> to steal LM/NTLM hashes.
> 
>> PoC: During rasterization, entities declared in the DTD are 
>> dereferenced and the content of the target file is included in
>> the output. Command-line used: "inkscape -e xxe-inkscape.png
>> xxe.svg" (PoC files are attached to the ticket)
> 
>> References: CWE-827: Improper Control of Document Type Definition
>>  http://cwe.mitre.org/data/definitions/827.html
> 
>> Regards, Nicolas Grégoire
> 
> This already has a CVE reference in the page:
> 
> CVE References
> 
> 2012-1102

To clarify that CVE was assigned to
http://seclists.org/oss-sec/2012/q1/549

http://seclists.org/oss-sec/2012/q1/549

so this is probably an error, someone needs to tidy that bug up and
post links to the source/etc so I can see whats going on.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQ0TpTAAoJEBYNRVNeJnmToVkQAL15KAplZyCcwZFZR2PqVr0V
ZbTvQXo93A3FuAlVDZ6FQQJSMU1E5EMpuD80816JLuUgFe1he/VwUoCtUknPdz5n
cgXNCAHAtbEt54bCcRKoVCeFHTnYP0MzA2PDOoRFuRgkUoUwFv6ilL5dcZD8pehq
ZwEWGVE/IDPJ+yFUma+FwtSP0olxoH6ZOP79RPgGoaPrCDfsLRjloKRKX4IUXSHy
aN5wGNVd9RfCCdtjwb8Qd0DakXwqJ0B0spFDK6ZhbtJl7IxdQqEiIndJ6+EhJRQh
A9njFDUjtIUM5jqUe7/Lb2Hzi5cno120dBKxvU/PLk0D7ZSErfI2ZneoxIIIdk42
+kNQ1qT8/08QsnicVlqP9RpUiW9fqx4ndzazNUjCcTyegnjyYNm2VQlOC0quEDyo
DzY2l2PED+A4HZ+gQW0uUcMWuDAaH7o2ti6CGUPgd5IPBYbBJpXBRZmw26QSD71M
xs50rPHiJhuJiw8s6q7M/sq/rf7ixe/AtJ5bfYntzD9pCaxkG7Q/FZytEXjIwiGb
+mqN6q52Gnc6R+neY22la/xwwRnRjYCDIUz/2r4Xt9EV1I5XbS9Zn24DDLE7YFJw
KT1hWAa8GqvmUgv5FjB20M9AANyi7wxUlzdnKsiL3WOJdVpApE2cDpBC41PH9WDZ
EN02SxWlecA1X7CgMGpc
=Bzwi
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ