CVE-2021-42704 - Vulnerability Details - OpenCVE

Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Inkscape	Inkscape

Configuration 1 [-]

cpe:2.3:a:inkscape:inkscape:0.91:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2021-42704
https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03
https://www.cve.org/CVERecord?id=CVE-2021-42704
https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-05-18T16:24:51.499471Z

Updated: 2024-09-17T00:40:40.921Z

Reserved: 2021-10-18T00:00:00

Link: CVE-2021-42704

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-05-18T17:15:08.207

Modified: 2024-11-21T06:28:00.490

Link: CVE-2021-42704

Redhat

Severity : Moderate

Publid Date: 2022-05-18T00:00:00Z

Links: CVE-2021-42704 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Inkscape", "vendor": "Inkscape", "versions": [{"status": "affected", "version": "0.91"}]}], "credits": [{"lang": "en", "value": "Tran Van Khang \u2013 khangkito (VinCSS), working with Trend Micro\u2019s Zero Day Initiative, reported these vulnerabilities to CISA."}], "datePublic": "2022-05-12T00:00:00", "descriptions": [{"lang": "en", "value": "Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-01T13:59:19", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/"}], "solutions": [{"lang": "en", "value": "Inkscape has fixed these vulnerabilities and recommends users update to Version Inkscape 1.0 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Inkscape Out-of-bounds Write", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-05-12T21:42:00.000Z", "ID": "CVE-2021-42704", "STATE": "PUBLIC", "TITLE": "Inkscape Out-of-bounds Write"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Inkscape", "version": {"version_data": [{"version_affected": "=", "version_value": "0.91"}]}}]}, "vendor_name": "Inkscape"}]}}, "credit": [{"lang": "eng", "value": "Tran Van Khang \u2013 khangkito (VinCSS), working with Trend Micro\u2019s Zero Day Initiative, reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-787 Out-of-bounds Write"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03"}, {"name": "https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/", "refsource": "CONFIRM", "url": "https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/"}]}, "solution": [{"lang": "en", "value": "Inkscape has fixed these vulnerabilities and recommends users update to Version Inkscape 1.0 or later."}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:38:50.053Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-42704", "datePublished": "2022-05-18T16:24:51.499471Z", "dateReserved": "2021-10-18T00:00:00", "dateUpdated": "2024-09-17T00:40:40.921Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:inkscape:inkscape:0.91:*:*:*:*:*:*:*", "matchCriteriaId": "DF5D548A-F1D4-4BAA-96BA-DA562A78C5C6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code."}, {"lang": "es", "value": "La versi\u00f3n 0.91 de Inkscape es vulnerable a una escritura fuera de l\u00edmites, lo que puede permitir a un atacante ejecutar c\u00f3digo de forma arbitraria"}], "id": "CVE-2021-42704", "lastModified": "2024-11-21T06:28:00.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-18T17:15:08.207", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}