Lucene search

Ubuntu.comUB:CVE-2018-1000639

HistoryAug 20, 2018 - 12:00 a.m.

CVE-2018-1000639

2018-08-2000:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

61.6%

JSON

LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability
in SVG parsing functionality that can result in disclosure of data, server
side request forgery, port scanning, possible rce. This attack appear to be
exploitable via Specially crafted SVG file.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlatexdraw< anyUNKNOWN
ubuntu20.04noarchlatexdraw< anyUNKNOWN
ubuntu22.04noarchlatexdraw< anyUNKNOWN
ubuntu23.10noarchlatexdraw< anyUNKNOWN
ubuntu24.04noarchlatexdraw< anyUNKNOWN
ubuntu16.04noarchlatexdraw< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	latexdraw	< any	UNKNOWN
ubuntu	20.04	noarch	latexdraw	< any	UNKNOWN
ubuntu	22.04	noarch	latexdraw	< any	UNKNOWN
ubuntu	23.10	noarch	latexdraw	< any	UNKNOWN
ubuntu	24.04	noarch	latexdraw	< any	UNKNOWN
ubuntu	16.04	noarch	latexdraw	< any	UNKNOWN

References

0dd.zone/2018/08/05/LatexDraw-XXE/

github.com/arnobl/latexdraw/issues/10

launchpad.net/bugs/cve/CVE-2018-1000639

nvd.nist.gov/vuln/detail/CVE-2018-1000639

security-tracker.debian.org/tracker/CVE-2018-1000639

www.cve.org/CVERecord?id=CVE-2018-1000639

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

61.6%

JSON

Related for UB:CVE-2018-1000639