~ / search / GHSA-wfw6-mmmp-87xm

GHSA-wfw6-mmmp-87xm

Improper Input Validation in Apache Batik

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-0250

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.xmlgraphics:batik >= 1.0, < 1.8 1.8

Details

As written in the advisory (Markdown source, shown as plain text).

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

References

External links from the advisory. They lead to third-party sites.