CVE-2022-41704
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
Summary
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
Original description
The description as published by the source.
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-41704 batik Fixed in: 1.12-4+deb11u1
- Ubuntu UBUNTU-CVE-2022-41704 batik Fixed in: 1.7.ubuntu-8ubuntu2.14.04.3+esm1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- web lists.apache.org
- web openwall.com
- web lists.debian.org