Skip to content
OpenAdvisories
High USN-3281-1 1 CVE

fop vulnerability

Published May 9, 2017 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Pierre Ernst discovered that Apache Fop incorrectly handled XML external
entities. A remote attacker could possibly use this issue to obtain
sensitive files from the filesystem, or cause a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS fop 1:1.1.dfsg-2ubuntu1.1

Vulnerabilities 1

  • High 7.3
    CVE-2017-5661

    Improper Restriction of XML External Entity Reference in Apache FOP

    In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is …

    Apache Software Foundation Apache FOP fop fop Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2017-5661