Apache XML Graphics Batik vulnerable to code execution via SVG.

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-41704 · ADVISORY
• apache/xmlgraphics-batik commit 905f368 · WEB
• issues.apache.org/jira/browse/BATIK-1338 · WEB
• lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf · WEB
• lists.debian.org/debian-lts-announce/2022/10/msg00038.html · WEB
• security.gentoo.org/glsa/202401-11 · WEB
• debian.org/security/2022/dsa-5264 · WEB
• xmlgraphics.apache.org/security.html · WEB
• svn.apache.org/repos/asf/xmlgraphics/batik/trunk · WEB
• openwall.com/lists/oss-security/2022/10/25/2 · WEB

org.apache.xmlgraphics:batik のその他の脆弱性

• CVE-2022-42890高 7.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Ap…
• CVE-2022-40146高 7.5Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This is…
• CVE-2022-38648中 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue …
• CVE-2022-38398中 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. Thi…
• CVE-2019-17566高 7.5Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a sp…