Untrusted code execution in Apache XML Graphics Batik

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-42890 · ADVISORY
• apache/xmlgraphics-batik commit 401aa85 · WEB
• apache/xmlgraphics-batik commit 52f7a1a · WEB
• apache/xmlgraphics-batik commit eada57c · WEB
• issues.apache.org/jira/browse/BATIK-1345 · WEB
• lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly · WEB
• lists.debian.org/debian-lts-announce/2022/10/msg00038.html · WEB
• security.gentoo.org/glsa/202401-11 · WEB
• debian.org/security/2022/dsa-5264 · WEB
• xmlgraphics.apache.org/security.html · WEB
• svn.apache.org/repos/asf/xmlgraphics/batik/trunk · WEB

org.apache.xmlgraphics:batik のその他の脆弱性

• CVE-2022-41704高 7.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Gra…
• CVE-2022-40146高 7.5Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This is…
• CVE-2022-38648中 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue …
• CVE-2022-38398中 5.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. Thi…
• CVE-2019-17566高 7.5Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a sp…