Non notée
CVE-2018-8013 In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the…
Description
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Batik | Versions non publiées |
Références
- 104252 www.securityfocus.com
- [debian-lts-announce] 20180525 [SECURITY] [DLA 1385-1] batik security update lists.debian.org
- DSA-4215 www.debian.org
- USN-3661-1 usn.ubuntu.com
- [xmlgraphics-batik-dev] 20180523 [CVE-2018-8013] Apache Batik information disclosure vulnerability mail-archives.apache.org
- 1040995 www.securitytracker.com
- [xmlgraphics-commits] 20200615 svn commit: r1878851 - /xmlgraphics/site/trunk/content/security.mdtext lists.apache.org
- [xmlgraphics-commits] 20200615 svn commit: r1878850 - /xmlgraphics/site/trunk/content/security.mdtext lists.apache.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- xmlgraphics.apache.org xmlgraphics.apache.org
- www.oracle.com www.oracle.com
- GLSA-202401-11 security.gentoo.org
Chronologie
- Publiée
- Dernière modification