Skip to content
OpenAdvisories
Critical USN-3661-1 1 CVE

batik vulnerability

Published May 29, 2018 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Batik incorrectly handled certain XML.
An attacker could possibly use this to expose sensitive information.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS batik 1.7.ubuntu-8ubuntu2.14.04.3

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-8013 EPSS 19%

    Deserialization of Untrusted Data in Apache Batik

    In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling n…

    Apache Software Foundation Apache Batik batik batik Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2018-8013