Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/10/25/3

https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly

https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html

https://security.gentoo.org/glsa/202401-11

https://www.debian.org/security/2022/dsa-5264

Related Vulnerabilities

CVE-2020-1745 Vulnerability in maven package io.undertow:undertow-core

CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-record-serialization-services

CVE-2018-1000613 Vulnerability in maven package org.apache.servicemix.bundles:org.apache.servicemix.bundles.bcprov-jdk15on

CVE-2020-8124 Vulnerability in maven package org.webjars.npm:url-parse

CVE-2020-14967 Vulnerability in maven package org.webjars.npm:jsrsasign

Severity

High

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory