CVE-2022-42890
Apache Batik prior to 1.16 allows RCE via scripting
Summary
Apache Batik prior to 1.16 allows RCE via scripting
Original description
The description as published by the source.
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-42890 batik Fixed in: 1.12-4+deb11u1
- Ubuntu UBUNTU-CVE-2022-42890 batik Fixed in: 1.7.ubuntu-8ubuntu2.14.04.3+esm1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- web lists.apache.org
- web openwall.com
- web lists.debian.org