CVE-2015-0250
Fixed in a distro release EPSS 17%
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Products: canonical ubuntu_linux, apache batik, redhat jboss_enterprise_brms_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.xmlgraphics:batik | 1.8 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | batik | 1.7+dfsg-5 |
| Debian 13 | batik | 1.7+dfsg-5 |
| Debian 14 | batik | 1.7+dfsg-5 |
| Debian 6.0 | batik | 1.7-6+deb6u1 |
| Debian 7 | batik | 1.7+dfsg-3+deb7u1 |
| Ubuntu 14.04 LTS | batik | 1.7.ubuntu-8ubuntu2.14.04.1 |