High severity vulnerability that affects org.apache.pdfbox:pdfbox

高危 7.8CVE-2016-2175 · GHSA-4c32-xmgj-2g98 · Published 01/06/2016 · updated 17/06/2026

要点

CVE-2016-2175 是影响 org.apache.pdfbox:pdfbox, pdfbox (apache) 的高危 (CVSS 7.8)漏洞。
未来 30 天内被利用的概率（EPSS）：3.8%，高于 90.1% 的漏洞。
修复：升级到 2.0.1, 1.8.12 或更高版本。

Package	Affected versions	Patched versions
org.apache.pdfbox:pdfbox Maven	`≥ 2.0.0, < 2.0.1< 1.8.12`	`2.0.11.8.12`
pdfbox apache	`= 1.8.0= 1.8.1= 1.8.10= 1.8.11= 1.8.2= 1.8.3= 1.8.4= 1.8.5= 1.8.6= 1.8.7= 1.8.8= 1.8.9= 2.0`	No fix yet

Description

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

NVD description

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

References

org.apache.pdfbox:pdfbox 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.pdfbox:pdfbox

Maven

≥ 2.0.0, < 2.0.1< 1.8.12

2.0.11.8.12

pdfbox

apache

= 1.8.0= 1.8.1= 1.8.10= 1.8.11= 1.8.2= 1.8.3= 1.8.4= 1.8.5= 1.8.6= 1.8.7= 1.8.8= 1.8.9= 2.0

No fix yet

Description

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

NVD description

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

org.apache.pdfbox:pdfbox 的其他漏洞

查看全部 →