Not rated
CVE-2022-42890 A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache XML Graphics 1.15 | earliest → 1.15 | No fix stated |
References
- lists.apache.org lists.apache.org
- [oss-security] 20221025 [CVE-2022-42890] Apache Batik information disclosure vulnerability www.openwall.com
- [debian-lts-announce] 20221029 [SECURITY] [DLA 3169-1] batik security update lists.debian.org
- DSA-5264 www.debian.org
- GLSA-202401-11 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of Apache XML Graphics
The 5 CVEs of Apache XML Graphics →
CVE-2022-41704
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG
7.5
High
CVE-2022-38398
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru…
Not rated
CVE-2022-38648
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external…
Not rated
CVE-2022-40146
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files…
Not rated