7.5
High
CVE-2022-41704 A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG
Description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache XML Graphics 1.15 | earliest → 1.15 | No fix stated |
References
- lists.apache.org lists.apache.org
- [oss-security] 20221025 [CVE-2022-41704] Apache Batik information disclosure vulnerability www.openwall.com
- [debian-lts-announce] 20221029 [SECURITY] [DLA 3169-1] batik security update lists.debian.org
- DSA-5264 www.debian.org
- GLSA-202401-11 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of Apache XML Graphics
The 5 CVEs of Apache XML Graphics →
CVE-2022-42890
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript
Not rated
CVE-2022-38398
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru…
Not rated
CVE-2022-38648
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external…
Not rated
CVE-2022-40146
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files…
Not rated