| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.apache.xmlgraphics:batik | ≥ 1.0, < 1.10 | 1.10 |
| batik | ≥ 1.0, < 1.10 | 1.10 |
| business intelligence | = 11.1.1.7.0= 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0 | |
| communications diameter signaling router | < 8.3 | 8.3 |
| communications metasolv solution | = 6.3.0 | |
| communications webrtc session controller | < 7.2 | 7.2 |
| data integrator | = 12.2.1.3.0 | |
| enterprise repository | = 11.1.1.7.0= 12.1.3.0.0 | |
| financial services analytical applications infrastructure | ≥ 7.3.3.0.0, ≤ 7.3.3.0.2≥ 8.0.0.0.0, ≤ 8.0.7.1.0 | |
| fusion middleware mapviewer | = 12.2.1.2= 12.2.1.3 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| insurance calculation engine | = 10.1.1= 10.2.1 | |
| insurance policy administration j2ee | = 10.0= 10.2 | |
| jd edwards enterpriseone tools | = 9.2 | |
| retail back office | = 13.3= 13.4= 14= 14.1 | |
| retail central office | = 14.1 | |
| retail integration bus | = 17.0 | |
| retail order broker | = 15.0= 16.0= 5.1= 5.2 | |
| retail point-of-service | = 13.4= 14.0= 14.1 | |
| retail returns management | = 14.1 |
In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí