CVE-2016-2175
Fixed in a distro release EPSS 4%
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Products: apache pdfbox, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.pdfbox:pdfbox | 1.8.12 |
| Maven | org.apache.pdfbox:pdfbox | 2.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libpdfbox-java | 1:1.8.12-1 |
| Debian 13 | libpdfbox-java | 1:1.8.12-1 |
| Debian 14 | libpdfbox-java | 1:1.8.12-1 |
| Debian 7 | libpdfbox-java | 1:1.7.0+dfsg-4+deb7u1 |
| Debian 8 | libpdfbox-java | 1:1.8.7+dfsg-1+deb8u1 |
| Ubuntu 16.04 LTS | libpdfbox-java | no fix |