CVE Feed

    Dashboard / CVE / CVE-2015-0250

    CVE-2015-0250

    XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

    Published:Jul 25, 2012
    Last Modified:Apr 12, 2025
    EPS:Mar 24, 2015
    EPSS Score:0.01042
    CVSS Score:6.4

    Affected Products

    Vendor
    Apache
    Product
    Batik
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Redhat
    Product
    Jboss Bpms
    Vendor
    Redhat
    Product
    Jboss Brms
    Vendor
    Redhat
    Product
    Jboss Enterprise Brms Platform

    Exploits

    http://seclists.org/fulldisclosure/2015/Mar/142http://seclists.org/fulldisclosure/2015/Mar/142

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-221 Data Serialization External Entities Blowup

    Related CVEs

    CVE-2022-42890 (CVSS 7.5) — A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via Jav…
    CVE-2022-41704 (CVSS 7.5) — A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. Thi…
    CVE-2022-38398 (CVSS 5.3) — Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a …
    CVE-2022-38648 (CVSS 5.3) — Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch e…
    CVE-2022-40146 (CVSS 7.5) — Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access …
    CVE-2020-11987 (CVSS 8.2) — Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the Nod…
    CVE-2019-17566 (CVSS 7.5) — Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:h…
    CVE-2018-8013 (CVSS 9.8) — In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string f…
    CVE-2017-5662 (CVSS 7.3) — In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to ar…
    CVE-2005-0508 (CVSS 4.6) — Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls vi…

    References

    http://advisories.mageia.org/MGASA-2015-0138.html
    http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
    http://rhn.redhat.com/errata/RHSA-2016-0041.html
    http://rhn.redhat.com/errata/RHSA-2016-0042.html
    http://seclists.org/fulldisclosure/2015/Mar/142
    http://www-01.ibm.com/support/docview.wss?uid=swg21963275
    http://www.debian.org/security/2015/dsa-3205
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:203
    http://www.securitytracker.com/id/1032781
    http://www.ubuntu.com/usn/USN-2548-1
    http://xmlgraphics.apache.org/security.html
    http://advisories.mageia.org/MGASA-2015-0138.html
    http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
    http://rhn.redhat.com/errata/RHSA-2016-0041.html
    http://rhn.redhat.com/errata/RHSA-2016-0042.html
    http://seclists.org/fulldisclosure/2015/Mar/142
    http://www-01.ibm.com/support/docview.wss?uid=swg21963275
    http://www.debian.org/security/2015/dsa-3205
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:203
    http://www.securitytracker.com/id/1032781
    http://www.ubuntu.com/usn/USN-2548-1
    http://xmlgraphics.apache.org/security.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High