Description

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

Remediation

References

http://seclists.org/fulldisclosure/2015/Mar/142

http://xmlgraphics.apache.org/security.html

http://www.ubuntu.com/usn/USN-2548-1

http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html

http://www.mandriva.com/security/advisories?name=MDVSA-2015:203

http://advisories.mageia.org/MGASA-2015-0138.html

http://rhn.redhat.com/errata/RHSA-2016-0041.html

http://rhn.redhat.com/errata/RHSA-2016-0042.html

http://www-01.ibm.com/support/docview.wss?uid=swg21963275

http://www.securitytracker.com/id/1032781

http://www.debian.org/security/2015/dsa-3205

Related Vulnerabilities

CVE-2020-8137 Vulnerability in npm package uppy

CVE-2014-4671 Vulnerability in npm package hapi

CVE-2018-16469 Vulnerability in npm package merge

CVE-2020-8158 Vulnerability in npm package typeorm

CVE-2016-0712 Vulnerability in maven package org.apache.portals.jetspeed-2:jetspeed-portal

Severity

Critical

Tags

Exploit Vendor Advisory Patch NVD-CWE-Other