Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs.

Several format string problems where fixed in inkscape.

  - A format string vulnerability in Inkscape allows     user-assisted remote attackers to execute arbitrary code     via format string specifiers in a URI, which is not     properly handled by certain dialogs. (CVE-2007-1463)

  - Format string vulnerability in the whiteboard Jabber     protocol in Inkscape allows user-assisted remote     attackers to execute arbitrary code via unspecified     vectors. (CVE-2007-1464)

A flaw was discovered in Inkscape's use of format strings. If a user were tricked into opening a specially crafted URI in Inkscape, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several format string problems where fixed in inkscape.

CVE-2007-1463: A format string vulnerability in Inkscape allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs.

CVE-2007-1464: Format string vulnerability in the whiteboard Jabber protocol in Inkscape allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-200704-10 (Inkscape: Two format string vulnerabilities)

    Kees Cook has discovered two vulnerabilities in Inkscape. The     application does not properly handle format string specifiers in some     dialog boxes. Inkscape is also vulnerable to another format string     error in its Jabber whiteboard protocol.
  Impact :

    A remote attacker could entice a user to open a specially crafted URI,     possibly leading to execution of arbitrary code with the privileges of     the user running Inkscape.
  Workaround :

    There is no known workaround at this time.

Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs.

Updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
29465	SuSE 10 Security Update : inkscape (ZYPP Patch Number 3061)	Nessus	SuSE Local Security Checks	medium
28034	Ubuntu 5.10 / 6.06 LTS / 6.10 : inkscape vulnerability (USN-438-1)	Nessus	Ubuntu Local Security Checks	medium
27272	openSUSE 10 Security Update : inkscape (inkscape-3062)	Nessus	SuSE Local Security Checks	medium
25055	GLSA-200704-10 : Inkscape: Two format string vulnerabilities	Nessus	Gentoo Local Security Checks	medium
24895	Mandrake Linux Security Advisory : inkscape (MDKSA-2007:069)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-1463

critical

Tenable Plugins

medium

medium

medium

medium

medium