CVE-2012-5656

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931Patch
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.htmlMailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.htmlMailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.htmlMailing List
http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.htmlMailing List
http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.htmlMailing List
http://www.openwall.com/lists/oss-security/2012/12/20/3Exploit, Mailing List
http://www.securityfocus.com/bid/56965Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1712-1Third Party Advisory
https://bugs.launchpad.net/inkscape/+bug/1025185Exploit, Issue Tracking
https://launchpad.net/inkscape/+milestone/0.48.4Product
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931Patch
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.htmlMailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.htmlMailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.htmlMailing List
http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.htmlMailing List
http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.htmlMailing List
http://www.openwall.com/lists/oss-security/2012/12/20/3Exploit, Mailing List
http://www.securityfocus.com/bid/56965Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1712-1Third Party Advisory
https://bugs.launchpad.net/inkscape/+bug/1025185Exploit, Issue Tracking
https://launchpad.net/inkscape/+milestone/0.48.4Product

Timeline

Published: Jan 18, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56575.0The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow rem CVE-2012-56582.1rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cle CVE-2012-56593.7Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 an CVE-2012-56606.9abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions CVE-2012-56625.8x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f CVE-2012-56637.5The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writ CVE-2012-56654.3ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit CVE-2012-56664.3Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote a CVE-2012-56674.4Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a CVE-2012-56684.3FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors rela CVE-2012-56694.3The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibl CVE-2012-56704.3The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds writ