Description
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Remediation
References
http://advisories.mageia.org/MGASA-2015-0138.html
http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
http://rhn.redhat.com/errata/RHSA-2016-0041.html
http://rhn.redhat.com/errata/RHSA-2016-0042.html
http://seclists.org/fulldisclosure/2015/Mar/142
http://www.debian.org/security/2015/dsa-3205
http://www.mandriva.com/security/advisories?name=MDVSA-2015:203
http://www.securitytracker.com/id/1032781
http://www.ubuntu.com/usn/USN-2548-1
http://www-01.ibm.com/support/docview.wss?uid=swg21963275
http://xmlgraphics.apache.org/security.html
Related Vulnerabilities
CVE-2021-27515 Vulnerability in maven package org.webjars.npm:url-parse
CVE-2018-1000614 Vulnerability in maven package org.onosproject:onos-netconf-provider-alarm
CVE-2020-8203 Vulnerability in maven package org.webjars.bower:lodash
CVE-2023-26479 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-parser
CVE-2021-28165 Vulnerability in maven package org.eclipse.jetty:jetty-io