Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/10/25/3

https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly

https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html

https://security.gentoo.org/glsa/202401-11

https://www.debian.org/security/2022/dsa-5264

Related Vulnerabilities

CVE-2020-2120 Vulnerability in maven package org.jenkins-ci.plugins:fitnesse

CVE-2021-20218 Vulnerability in maven package io.fabric8:kubernetes-client

CVE-2019-1003052 Vulnerability in maven package org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin

CVE-2022-41930 Vulnerability in maven package org.xwiki.platform:xwiki-platform-user-profile-ui

CVE-2022-36920 Vulnerability in maven package org.jenkins-ci.plugins:coverity

Severity

High

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory