Bugzilla Bug 101842

Javier Fernandez-Sanguino Pena has reported a vulnerability in Inkscape, which
can be exploited by malicious, local users to perform certain actions on a
vulnerable system with escalated privileges.

The vulnerability is caused due to the temporary file "/tmp/tmpepsifile.epsi"
being created insecurely by ps2epsi.sh. This can be exploited via symlink
attacks to create or overwrite arbitrary files with the privileges of the user
running the affected application.

The vulnerability has been reported in version 0.41. Prior versions may also be
affected.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.




Solution:
This vulnerability has been fixed in version 0.42.

0.42 is in the tree, but still masked.

graphics herd: what were your plans for this ? If you pefer to keep it masked
for a long time, maybe you could backport the patch in 0.41 ?

Inkscape-0.42 has many bugs. Upstream is still preparing patches, which will
fix
them. Should be available in this week. I'll add them as soon as possible.

OK, setting status to wait for upstream.

Inkscape 0.42.2 Released, August 26, 2005

It's in portage now.

Arches please test and mark stale. 

x86 done

Stable on amd64

amd64 marked stable, thanks for testing :)

sparc stable.

stable on ppc64

Stable on ppc.

Ready for GLSA vote.
I tend to vote NO as this is a quite unused script...

I tend to vote NO as well. 

agree with Koon+jaervosz, vote NO.

Closing without GLSA, feel free to reopen if you disagree. 

and.... closing.