Oracle Business Intelligence Publisher Multiple Vulnerabilities (October 2018 CPU)

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.181016, 11.1.1.9.x prior to 11.1.1.9.181016, 12.2.1.3.x prior to 12.2.1.3.181016, or 12.2.1.4.x prior to 12.2.1.4.181016. It is, therefore, affected by multiple vulnerabilities as note...

Oracle Business Intelligence Publisher Multiple Vulnerabilities (April 2018 CPU)

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.180417 or 11.1.1.9.x prior to 11.1.1.9.180417, similarly, versions 12.2.1.2.x prior to 12.2.1.2.180116 and 12.2.1.3.x prior to 12.2.1.3.180116 are affected as noted in the April 2018...

Security Bulletin: Vulnerability in Apache Batik affects IBM Cúram Social Program Management (CVE-2018-8013)

Summary IBM Cúram Social Program Management uses the Apache Batik Library. In Apache Batik library prior to version 1.10, the class type has not being checked during the deserialization process of the subclass of AbstractDocument. Fix has been put in place to check the class type before...

The vulnerability of the library for working with SVG images in Apache Batik, related to the restoration of unreliable data structures in memory, allows attackers to gain access to protected data or cause service failures.

The vulnerability of the Apache Batik library for working with SVG images is related to the restoration of a dubious data structure in memory the “AbstractDocument” class. Exploiting this vulnerability could allow an attacker to gain access to protected data or cause service failures using the HT...

Security Bulletin: Security Vulnerability in Apache Batik (CVE-2015-0250)

Summary Apache Batik could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted SVG file, an attacker could exploit this vulnerability to reveal files and obtain sensitive information. Vulnerability Details CVEID: CVE-2015-0250 DESCRIPTION:...

Security Bulletin: IBM Cúram Social Program Management contains an Apache Batik Vulnerability (CVE-2015-0250)

Summary IBM Cúram is shipped with a third party library called Apache Batik, which is vulnerable to specially crafted SVG files. These files can potientially be used to reveal files and obtain sensitive information. Vulnerability Details CVEID: CVE-2015-0250 DESCRIPTION: Apache Batik could allow ...

Security Bulletin: Vulnerability in Apache Batik affects IBM Maximo Asset Management (CVE-2017-5662)

Summary Apache Batik used by IBM Maximo Asset Management could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. By using a specially-crafted SVG file, a remote attacker could exploit this vulnerability to...

Security Bulletin: IBM Jazz for Service Management Recommends to Install IBM Websphere Application Server Fixes to fix Multiple Security Vulnerabilities

Summary IBM Jazz for Service Management bundles IBM Websphere Application Server WAS v8.5 and below. These lower level of WAS profile releases are prone to various security vulnerability issues and is being fixed thru multiple interim fixes. We recommend to install these WAS interim fixes to fix...

Security Bulletin: Vulnerability in Apache Batik affects IBM Cúram Social Program Management (CVE-2017-5662)

Summary IBM Cúram Social Program Management uses the Apache Batik Library. Apache Batik could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. Vulnerability Details CVEID: CVE-2017-5662 DESCRIPTION: Apache...

Security Bulletin: IBM QRadar SIEM contains vulnerable components. (CVE-2015-0250)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2015-0250 DESCRIPTION: Apache Batik could allow a remote attacker to obtain sensitive information. By persuading a victim to ope...

Apache Batik Information Disclosure Vulnerability (CNVD-2018-10557)

Apache Batik also known as Batik SVG Toolkit or Batik Java SVG Toolkit is the U.S. Apache Apache Software Foundation's set of Java-based application programs mainly used to deal with SVG format images. An information disclosure vulnerability exists in Apache Batik versions 1.x prior to 1.10. An...

Debian DLA-1385-1 : batik security update

Man Yue Mo discovered a security vulnerability in Apache Batik, an SVG image library. A missing check for the class type before calling newInstance when deserializing a subclass of AbstractDocument could lead to information disclosure. For Debian 7 'Wheezy', these problems have been fixed in...

Debian: Security Advisory (DLA-1385-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1385-1] batik security update

Package : batik Version : 1.7+dfsg-3+deb7u3 CVE ID : CVE-2018-8013 Debian Bug : 899374 Man Yue Mo discovered a security vulnerability in Apache Batik, an SVG image library. A missing check for the class type before calling newInstance when deserializing a subclass of AbstractDocument could lead t...

Deserialization of untrusted data

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

DEBIAN-CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...