Date: Tue, 18 Dec 2012 20:53:55 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr> Subject: Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/18/2012 08:44 PM, Kurt Seifried wrote: > On 12/17/2012 01:27 PM, Nicolas Grégoire wrote: > >> Inkscape is vulnerable to XXE attacks during >> rasterization/export of SVG images: >> https://bugs.launchpad.net/inkscape/+bug/1025185 > >> Impact: The impact of this vulnerability range form denial of >> service to file disclosure. Under Windows, it can also be used >> to steal LM/NTLM hashes. > >> PoC: During rasterization, entities declared in the DTD are >> dereferenced and the content of the target file is included in >> the output. Command-line used: "inkscape -e xxe-inkscape.png >> xxe.svg" (PoC files are attached to the ticket) > >> References: CWE-827: Improper Control of Document Type Definition >> http://cwe.mitre.org/data/definitions/827.html > >> Regards, Nicolas Grégoire > > This already has a CVE reference in the page: > > CVE References > > 2012-1102 To clarify that CVE was assigned to http://seclists.org/oss-sec/2012/q1/549 http://seclists.org/oss-sec/2012/q1/549 so this is probably an error, someone needs to tidy that bug up and post links to the source/etc so I can see whats going on. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQ0TpTAAoJEBYNRVNeJnmToVkQAL15KAplZyCcwZFZR2PqVr0V ZbTvQXo93A3FuAlVDZ6FQQJSMU1E5EMpuD80816JLuUgFe1he/VwUoCtUknPdz5n cgXNCAHAtbEt54bCcRKoVCeFHTnYP0MzA2PDOoRFuRgkUoUwFv6ilL5dcZD8pehq ZwEWGVE/IDPJ+yFUma+FwtSP0olxoH6ZOP79RPgGoaPrCDfsLRjloKRKX4IUXSHy aN5wGNVd9RfCCdtjwb8Qd0DakXwqJ0B0spFDK6ZhbtJl7IxdQqEiIndJ6+EhJRQh A9njFDUjtIUM5jqUe7/Lb2Hzi5cno120dBKxvU/PLk0D7ZSErfI2ZneoxIIIdk42 +kNQ1qT8/08QsnicVlqP9RpUiW9fqx4ndzazNUjCcTyegnjyYNm2VQlOC0quEDyo DzY2l2PED+A4HZ+gQW0uUcMWuDAaH7o2ti6CGUPgd5IPBYbBJpXBRZmw26QSD71M xs50rPHiJhuJiw8s6q7M/sq/rf7ixe/AtJ5bfYntzD9pCaxkG7Q/FZytEXjIwiGb +mqN6q52Gnc6R+neY22la/xwwRnRjYCDIUz/2r4Xt9EV1I5XbS9Zn24DDLE7YFJw KT1hWAa8GqvmUgv5FjB20M9AANyi7wxUlzdnKsiL3WOJdVpApE2cDpBC41PH9WDZ EN02SxWlecA1X7CgMGpc =Bzwi -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.