EUVD-2018-0597

Malware in sbrugna...

CVE-2017-1000498

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution...

com.graphhopper:graphhopper-android (>=0.4.0 <=0.11.0), org.mapsforge:mapsforge-map-android (>=0.7.0 <=0.9.1) +5 more potentially affected by CVE-2017-1000498 via com.caverock:androidsvg (=1.2.2-beta-1)

com.caverock:androidsvg MAVEN version =1.2.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on com.caverock:androidsvg and may be impacted: - com.graphhopper:graphhopper-android =0.4.0, =0.7.0, =0.7.0, =0.6.0, =0.6.0, =5.4, =6.0.3 Source cves:...

CVE-2017-1000498

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution...