5 results (0.012 seconds)

CVSS: 4.4EPSS: 0%CPEs: 25EXPL: 0

CVE-2012-6076

https://notcve.org/view.php?id=CVE-2012-6076

Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, allow local users to obtain sensitive information, and possibly have other unspecified impacts. Inkscape anterior a v0.48.4 lee ficheros .eps desde /tmp en lugar del directorio actual, permitiendo a usuarios locales obtener información sensible y posiblemente tener otro impacto no especificado. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654341 http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html http://www.openwall.com/lists/oss-security/2012/12/30/2 http://www.ubuntu.com/usn/USN-1712-1 https://bugs.launchpad.net/inkscape/+bug/911146 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 2

CVE-2012-5656

https://notcve.org/view.php?id=CVE-2012-5656

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack. El proceso de rasterización en Inkscape antes de v0.48.4 permite a los usuarios locales leer archivos de su elección a través de entidades externas en un archivo SVG. Se trata de un ataque también conocido como ataque de inyección XML a una entidad externa (XXE). • http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931 http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html http://www.openwall.com/lists/oss-security/2012/12/20 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 6.8EPSS: 11%CPEs: 1EXPL: 0

CVE-2007-1464

https://notcve.org/view.php?id=CVE-2007-1464

Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. Vulnerabilidad de formato de cadena en el protocolo whiteboard Jabber del Inkscape anterior al 0.45.1 permite a atacantes con la intervención del usuario ejecutar código de su elección mediante vectores sin especificar. • http://secunia.com/advisories/24615 http://secunia.com/advisories/24661 http://secunia.com/advisories/24859 http://secunia.com/advisories/25072 http://sourceforge.net/project/shownotes.php?group_id=93438&release_id=495106 http://www.gentoo.org/security/en/glsa/glsa-200704-10.xml http://www.novell.com/linux/security/advisories/2007_8_sr.html http://www.securityfocus.com/archive/1/463710/100/0/threaded http://www.securityfocus.com/bid/23138 http://www.vupen.com/english/ •

CVSS: 6.8EPSS: 17%CPEs: 11EXPL: 0

CVE-2007-1463

https://notcve.org/view.php?id=CVE-2007-1463

Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs. Vulnerabilidad en el formato de cadena en el Inkscape anterior al 0.45.1 permite a atacantes con la intervención del usuario ejecutar código de su elección mediante especificadores del formato de cadena en una URI,lo que no es manejado correctamente mediante ciertos diálogos. • http://secunia.com/advisories/24584 http://secunia.com/advisories/24597 http://secunia.com/advisories/24615 http://secunia.com/advisories/24661 http://secunia.com/advisories/24859 http://secunia.com/advisories/25072 http://sourceforge.net/project/shownotes.php?group_id=93438&release_id=495106 http://www.gentoo.org/security/en/glsa/glsa-200704-10.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:069 http://www.novell.com/linux/security/advisories/2007_8_sr.html h •

CVSS: 5.1EPSS: 21%CPEs: 4EXPL: 2

CVE-2005-3737 – Inkscape 0.41/0.42 - '.SVG' Image Buffer Overflow

https://notcve.org/view.php?id=CVE-2005-3737

Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might allow remote attackers to execute arbitrary code via a SVG file with long CSS style property values. Desbordamiento de búfer en el importador SVG (style.cpp) de inkscape 0.41 a 0.42.2 podría permitir a atacantes remotos ejecutar código de su elección importando un fichero SVG malicioso con valores de hoja de estilos CSS largos. • https://www.exploit-db.com/exploits/26540 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330894 http://cvs.sourceforge.net/viewcvs.py/inkscape/inkscape/src/style.cpp?r1=1.110&r2=1.110.2.1 http://secunia.com/advisories/17651 http://secunia.com/advisories/17662 http://secunia.com/advisories/17778 http://secunia.com/advisories/17882 http://securityreason.com/securityalert/58 http://www.debian.org/security/2005/dsa-916 http://www.gentoo.org/security/en/glsa/glsa-2 •