[SECURITY] [DLA 1316-1] freeplane security update

2018-03-2418:00:23

lists.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

64.4%

JSON

Package : freeplane
Version : 1.1.3-2+deb7u1
CVE ID : CVE-2018-1000069
Debian Bug : 893663

Wojciech Reguła discovered that Freeplane, a program for working with
mind maps, was affected by a XML External Entity (XXE) vulnerability in
its mindmap loader that could compromise a user's machine by opening a
specially crafted mind map file.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.3-2+deb7u1.

We recommend that you upgrade your freeplane packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7alllibjortho-freeplane-java< 1.1.3-2+deb7u1libjortho-freeplane-java_1.1.3-2+deb7u1_all.deb
Debian9allfreeplane< 1.5.18-1+deb9u1freeplane_1.5.18-1+deb9u1_all.deb
Debian8alllibjortho-freeplane-java< 1.3.12-1+deb8u1libjortho-freeplane-java_1.3.12-1+deb8u1_all.deb
Debian8allfreeplane< 1.3.12-1+deb8u1freeplane_1.3.12-1+deb8u1_all.deb
Debian9allfreeplane-scripting-api< 1.5.18-1+deb9u1freeplane-scripting-api_1.5.18-1+deb9u1_all.deb
Debian7allfreeplane< 1.1.3-2+deb7u1freeplane_1.1.3-2+deb7u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	libjortho-freeplane-java	< 1.1.3-2+deb7u1	libjortho-freeplane-java_1.1.3-2+deb7u1_all.deb
Debian	9	all	freeplane	< 1.5.18-1+deb9u1	freeplane_1.5.18-1+deb9u1_all.deb
Debian	8	all	libjortho-freeplane-java	< 1.3.12-1+deb8u1	libjortho-freeplane-java_1.3.12-1+deb8u1_all.deb
Debian	8	all	freeplane	< 1.3.12-1+deb8u1	freeplane_1.3.12-1+deb8u1_all.deb
Debian	9	all	freeplane-scripting-api	< 1.5.18-1+deb9u1	freeplane-scripting-api_1.5.18-1+deb9u1_all.deb
Debian	7	all	freeplane	< 1.1.3-2+deb7u1	freeplane_1.1.3-2+deb7u1_all.deb