Security update for inkscape
SUSE Security Update: Security update for inkscape
inkscape was updated to fix a XXE (Xml eXternal Entity)
attack during rasterization of SVG images (CVE-2012-5656),
where the rendering of malicious SVG images could have
connected from inkscape to internal hosts.
Also inkscape would have loaded .EPS files from untrusted
/tmp occasionaly instead from the current directory.
(CVE-2012-6076)
Security Issue references:
* CVE-2012-6076
>
* CVE-2012-5656
>
| Announcement ID: | SUSE-SU-2013:0351-1 |
| Rating: | moderate |
| References: | #794958 #796306 |
| Affected Products: |
An update that fixes two vulnerabilities is now available.
Description:
inkscape was updated to fix a XXE (Xml eXternal Entity)
attack during rasterization of SVG images (CVE-2012-5656),
where the rendering of malicious SVG images could have
connected from inkscape to internal hosts.
Also inkscape would have loaded .EPS files from untrusted
/tmp occasionaly instead from the current directory.
(CVE-2012-6076)
Security Issue references:
* CVE-2012-6076
* CVE-2012-5656
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11 SP2:
zypper in -t patch sdksp2-inkscape-7380 - SUSE Linux Enterprise Desktop 11 SP2:
zypper in -t patch sledsp2-inkscape-7380
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64):
- inkscape-0.46-62.38.1
- inkscape-extensions-dia-0.46-62.38.1
- inkscape-extensions-extra-0.46-62.38.1
- inkscape-extensions-fig-0.46-62.38.1
- inkscape-extensions-gimp-0.46-62.38.1
- inkscape-lang-0.46-62.38.1
- SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64):
- inkscape-0.46-62.38.1
- inkscape-extensions-dia-0.46-62.38.1
- inkscape-extensions-extra-0.46-62.38.1
- inkscape-extensions-fig-0.46-62.38.1
- inkscape-extensions-gimp-0.46-62.38.1
- inkscape-lang-0.46-62.38.1
References:
- http://support.novell.com/security/cve/CVE-2012-5656.html
- http://support.novell.com/security/cve/CVE-2012-6076.html
- https://bugzilla.novell.com/794958
- https://bugzilla.novell.com/796306
- http://download.suse.com/patch/finder/?keywords=3665fd73e37c0c781853b6cda2d6e0de