Description

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

Remediation

References

http://advisories.mageia.org/MGASA-2015-0138.html

http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html

http://rhn.redhat.com/errata/RHSA-2016-0041.html

http://rhn.redhat.com/errata/RHSA-2016-0042.html

http://seclists.org/fulldisclosure/2015/Mar/142

http://www.debian.org/security/2015/dsa-3205

http://www.mandriva.com/security/advisories?name=MDVSA-2015:203

http://www.securitytracker.com/id/1032781

http://www.ubuntu.com/usn/USN-2548-1

http://www-01.ibm.com/support/docview.wss?uid=swg21963275

http://xmlgraphics.apache.org/security.html

Related Vulnerabilities

CVE-2023-32731 Vulnerability in maven package io.grpc:grpc-protobuf

CVE-2021-32859 Vulnerability in npm package baremetrics-calendar

CVE-2021-41251 Vulnerability in npm package @sap-cloud-sdk/core

CVE-2017-16030 Vulnerability in npm package useragent

CVE-2023-29529 Vulnerability in npm package matrix-js-sdk

Severity

Critical

Tags

Exploit Patch Vendor Advisory NVD-CWE-Other