| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.xmlgraphics:batik | ≥ 1.0, < 1.10 | 1.10 |
| batik | ≥ 1.0, < 1.10 | 1.10 |
| business intelligence | = 11.1.1.7.0= 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0 | |
| communications diameter signaling router | < 8.3 | 8.3 |
| communications metasolv solution | = 6.3.0 | |
| communications webrtc session controller | < 7.2 | 7.2 |
| data integrator | = 12.2.1.3.0 | |
| enterprise repository | = 11.1.1.7.0= 12.1.3.0.0 | |
| financial services analytical applications infrastructure | ≥ 7.3.3.0.0, ≤ 7.3.3.0.2≥ 8.0.0.0.0, ≤ 8.0.7.1.0 | |
| fusion middleware mapviewer | = 12.2.1.2= 12.2.1.3 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| insurance calculation engine | = 10.1.1= 10.2.1 | |
| insurance policy administration j2ee | = 10.0= 10.2 | |
| jd edwards enterpriseone tools | = 9.2 | |
| retail back office | = 13.3= 13.4= 14= 14.1 | |
| retail central office | = 14.1 | |
| retail integration bus | = 17.0 | |
| retail order broker | = 15.0= 16.0= 5.1= 5.2 | |
| retail point-of-service | = 13.4= 14.0= 14.1 | |
| retail returns management | = 14.1 |
In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free