DEBIAN-CVE-2018-1000069

FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+.

References

https://security-tracker.debian.org/tracker/CVE-2018-1000069

Affected packages

Debian:11 / freeplane

Package

Name: freeplane
Purl: pkg:deb/debian/freeplane?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.6-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000069.json"

Debian:12 / freeplane

Package

Name: freeplane
Purl: pkg:deb/debian/freeplane?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.6-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000069.json"

Debian:14 / freeplane

Package

Name: freeplane
Purl: pkg:deb/debian/freeplane?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.6-1

Affected versions

1.*

1.1.1-1

1.1.3-1

1.1.3-2

1.2.23-1~exp1

1.2.23-1

1.2.23-2

1.2.23+dfsg1-1

1.3.11-1

1.3.12-1

1.3.15-1

1.3.15-2

1.3.15-3

1.3.15-4

1.5.11-1

1.5.13-1

1.5.15-1

1.5.16-1

1.5.16-2

1.5.16-3

1.5.18-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000069.json"