Description
Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Check Point Software Technologies | Eclipse | All version lower or equal to 2017.2.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apktool | 2.2.4-1 | — |
| Debian 13 | apktool | 2.2.4-1 | — |
| Debian 12 | apktool | 2.2.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | apktool | No fix yet | — |