Description

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

Remediation

References

http://advisories.mageia.org/MGASA-2015-0138.html

http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html

http://rhn.redhat.com/errata/RHSA-2016-0041.html

http://rhn.redhat.com/errata/RHSA-2016-0042.html

http://seclists.org/fulldisclosure/2015/Mar/142

http://www.debian.org/security/2015/dsa-3205

http://www.mandriva.com/security/advisories?name=MDVSA-2015:203

http://www.securitytracker.com/id/1032781

http://www.ubuntu.com/usn/USN-2548-1

http://www-01.ibm.com/support/docview.wss?uid=swg21963275

http://xmlgraphics.apache.org/security.html

Related Vulnerabilities

CVE-2020-8268 Vulnerability in npm package json8-merge-patch

CVE-2020-15500 Vulnerability in maven package org.webjars.npm:tileserver-gl

CVE-2023-40311 Vulnerability in maven package org.opennms:opennms-webapp

CVE-2019-10779 Vulnerability in maven package stroom:stroom-app

CVE-2017-16150 Vulnerability in npm package wangguojing123

Severity

Critical

Tags

Exploit Patch Vendor Advisory NVD-CWE-Other