Skip to content
OpenAdvisories
Unscored USN-2548-1 1 CVE

batik vulnerability

Published Mar 25, 2015 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML
external entities by default. If a user or automated system were tricked
into opening a specially crafted SVG file, an attacker could possibly
obtain access to arbitrary files or cause resource consumption.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS batik 1.7.ubuntu-8ubuntu2.14.04.1

Vulnerabilities 1

  • Medium —
    CVE-2015-0250 EPSS 17%

    Improper Input Validation in Apache Batik

    XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

    batik batik org.apache.xmlgraphics:batik Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2015-0250