Description

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution

Remediation

References

https://github.com/BigBadaboom/androidsvg/issues/122

Related Vulnerabilities

CVE-2023-29516 Vulnerability in maven package org.xwiki.platform:xwiki-platform-attachment-ui

CVE-2020-15174 Vulnerability in maven package org.webjars.npm:electron

CVE-2022-25912 Vulnerability in npm package simple-git

CVE-2020-35510 Vulnerability in maven package org.jboss.remoting:jboss-remoting

CVE-2022-21222 Vulnerability in npm package css-what

Severity

High

Classification

CWE-611 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Issue Tracking Third Party Advisory