[SECURITY] Fedora 27 Update: batik-1.10-1.fc27

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

Debian DSA-4215-1 : batik - security update

Man Yue Mo, Lars Krapf and Pierre Ernst discovered that Batik, a toolkit for processing SVG images, did not properly validate its input. This would allow an attacker to cause a denial-of-service, mount cross-site scripting attacks, or access restricted files on the server. C Tenable Network...

[SECURITY] [DSA 4215-1] batik security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4215-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 02, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4215-1] batik security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4215-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 02, 2018 https://www.debian.org/security/faq -...

DSA-4215-1 batik - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4215-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : Batik vulnerability (USN-3661-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3661-1 advisory. It was discovered that Batik incorrectly handled certain XML. An attacker could possibly use this to expose sensitive information. Tenable has extracted the...

USN-3661-1: Batik vulnerability

It was discovered that Batik incorrectly handled certain XML. An attacker could possibly use this to expose sensitive information...

USN-3661-1 batik vulnerability

It was discovered that Batik incorrectly handled certain XML. An attacker could possibly use this to expose sensitive information...

Apache Batik Information Disclosure Vulnerability (CNVD-2018-10557)

Apache Batik also known as Batik SVG Toolkit or Batik Java SVG Toolkit is the U.S. Apache Apache Software Foundation's set of Java-based application programs mainly used to deal with SVG format images. An information disclosure vulnerability exists in Apache Batik versions 1.x prior to 1.10. An...

Debian DLA-1385-1 : batik security update

Man Yue Mo discovered a security vulnerability in Apache Batik, an SVG image library. A missing check for the class type before calling newInstance when deserializing a subclass of AbstractDocument could lead to information disclosure. For Debian 7 'Wheezy', these problems have been fixed in...

Debian: Security Advisory (DLA-1385-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1385-1] batik security update

Package : batik Version : 1.7+dfsg-3+deb7u3 CVE ID : CVE-2018-8013 Debian Bug : 899374 Man Yue Mo discovered a security vulnerability in Apache Batik, an SVG image library. A missing check for the class type before calling newInstance when deserializing a subclass of AbstractDocument could lead t...

DLA-1385-1 batik - security update

Bulletin has no description...

DEBIAN-CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

Deserialization of untrusted data

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

Apache Batik 1.x before 1.10 is vulnerable to information disclosure via deserializing a subclass of AbstractDocument, where inputStream-derived class name is used to invoke a no-arg constructor. The fix is to validate the class type before newInstance during deserialization; remediation is to up...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...