CVE-2015-0250
Improper Input Validation in Apache Batik
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Exploit likelihood
What each source reports
NVD Score used
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
CVE-2015-0250- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Updated
- 2026-11-02
CVE List No score
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
CVE-2015-0250- Updated
- 2026-11-02
EUVDEUVD-2022-5566 No score
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
EUVD-2022-5566- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wfw6-mmmp-87xm No score
Improper Input Validation in Apache Batik
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
GHSA-wfw6-mmmp-87xm- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVCLSA-2026-1778633124 No score
TuxCare security update for org.apache.xmlgraphics (10 CVEs)
TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.
- Record
CLSA-2026-1778633124- Updated
- 2026-11-02
OSV No score
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
CVE-2015-0250- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2015-0250 No score
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
DEBIAN-CVE-2015-0250- Updated
- 2026-11-02
OSVGHSA-wfw6-mmmp-87xm No score
Improper Input Validation in Apache Batik
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
GHSA-wfw6-mmmp-87xm- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2015-0138 No score
Updated batik packages fix security vulnerabilities
Updated batik packages fix security vulnerability:
Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files or cause resource consumption (CVE-2015-0250).
- Record
MGASA-2015-0138- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0250 No score
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
- Record
UBUNTU-CVE-2015-0250- Updated
- 2026-11-02
OSVUSN-2548-1 No score
batik vulnerability
Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary files or cause resource consumption.
- Record
USN-2548-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:batikMaven |
1.0 up to 1.8 | 1.8 |
org.apache.xmlgraphics:batik-animTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-awt-utilTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-bridgeTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-codecTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-cssTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-domTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extensionTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-extensionsTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.xmlgraphics:batik-gui-utilTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-gvtTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-jsTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-parserTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-rasterizerTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-rasterizer-extTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-scriptTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-slideshowTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-squiggleTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-squiggle-extTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svg-domTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svggenTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-svgppTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-swingTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-transcoderTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-ttf2svgTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-utilTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
org.apache.xmlgraphics:batik-xmlTuxCare:Maven From an advisory covering 10 CVEs |
1.7 up to 1.7-tuxcare.1 | 1.7-tuxcare.1 |
batikDebian:12 |
before 1.7+dfsg-5 | 1.7+dfsg-5 |
batikDebian:13 |
before 1.7+dfsg-5 | 1.7+dfsg-5 |
batikDebian:14 |
before 1.7+dfsg-5 | 1.7+dfsg-5 |
batikDebian:6.0 |
before 1.7-6+deb6u1, plus listed versions 1.7-6 |
1.7-6+deb6u1 |
batikDebian:7 |
before 1.7+dfsg-3+deb7u1, plus listed versions 1.7+dfsg-3 |
1.7+dfsg-3+deb7u1 |
batikMageia:4 |
before 1.8-0.1.svn1230816.10.mga4 | 1.8-0.1.svn1230816.10.mga4 |
batikUbuntu:14.04:LTS |
before 1.7.ubuntu-8ubuntu2.14.04.1, plus listed versions 1.7.ubuntu-8ubuntu2 |
1.7.ubuntu-8ubuntu2.14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0250 is a medium vulnerability (CVSS 6.4) in Apache Batik, published March 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in org.apache.xmlgraphics:batik 1.8.
References
ubuntu.com/usn/USN-2548-1
www-01.ibm.com/support/docview.wss?uid=swg21963275
mandriva.com/security/advisories?name=MDVSA-2015:203
debian.org/security/2015/dsa-3205
securitytracker.com/id/1032781
advisories.mageia.org/MGASA-2015-0138.html
Show 15 moreShow less
seclists.org/fulldisclosure/2015/Mar/142
rhn.redhat.com/errata/RHSA-2016-0042.html
xmlgraphics.apache.org/security.html
packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
nvd.nist.gov/vuln/detail/CVE-2015-0250
github.com/advisories/GHSA-wfw6-mmmp-87xm
security-tracker.debian.org/tracker/CVE-2015-0250
bugs.mageia.org/show_bug.cgi?id=15566
openwall.com/lists/oss-security/2015/03/17/4
ubuntu.com/security/CVE-2015-0250
cve.org/CVERecord?id=CVE-2015-0250