Skip to content
OpenAdvisories
High USN-3280-1 1 CVE

batik vulnerability

Published May 9, 2017 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Lars Krapf and Pierre Ernst discovered that Apache Batik incorrectly
handled XML external entities. A remote attacker could possibly use this
issue to obtain sensitive files from the filesystem, or cause a denial of
service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS batik 1.7.ubuntu-8ubuntu2.14.04.2

Vulnerabilities 1

  • High 7.3
    CVE-2017-5662

    Improper Restriction of XML External Entity Reference in Apache Batik

    In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application…

    Apache Software Foundation Apache Batik batik batik Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2017-5662