DSA-4175: -1 freeplane -- security update

Published Apr 18, 2018

Updated

freeplane - security update

Other sources

Wojciech Regula discovered an XML External Entity vulnerability in the XML Parser of the mindmap loader in freeplane, a Java program for working with mind maps, resulting in potential information disclosure if a malicious mind map file is opened.

Affected Software

2 affected components

debian/freeplane

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade freeplane to a version that resolves this vulnerability.
Patch DSA-4175-1

Event History

Apr 18, 2018

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2018-1000069

Frequently Asked Questions

Who is exposed to this issue?

Users of Debian's freeplane package are exposed if they open a malicious mind map file. The issue is in the XML parser used by the mind map loader.

What does an attacker need to exploit it?

An attacker needs to provide a malicious mind map file and have a user open it in freeplane. Successful exploitation can result in information disclosure through XML External Entity processing.

DSA-4175: -1 freeplane -- security update

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?