CVE-2024-28168

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: 2.9.

Users are recommended to upgrade to version 2.10, which fixes the issue.

FOP (Formatting Objects Processor) is a print formatter driven by XSL formatting objects (XSL-FO) and an output independent formatter. It is a Java application that reads a formatting object (FO) tree and renders the resulting pages to a specified output. Output formats currently supported include PDF, PS, PCL, AFP, XML (area tree representation), Print, AWT and PNG, and to a lesser extent, RTF and TXT. The primary output target is PDF.

Security Fix(es):

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: 2.9.

Users are recommended to upgrade to version 2.10, which fixes the issue.(CVE-2024-28168)

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

These are all security issues fixed in the xmlgraphics-fop-2.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issues:

xmlgraphics-fop was updated from version 2.8 to 2.10:

• Security issues fixed:

  • CVE-2024-28168: Fixed improper restriction of XML External Entity (XXE) reference (bsc#1231428)

• Upstream changes and bugs fixed:

  • Version 2.10:

    • footnote-body ignores rl-tb writing mode
    • SVG tspan content is displayed out of place
    • Added new schema to handle pdf/a and pdfa/ua
    • Correct fop version at runtime
    • NoSuchElementException when using font with no family name
    • Resolve classpath for binary distribution
    • Switch to spotbugs
    • Set an automatic module name
    • Rename packages to avoid conflicts with modules
    • Resize table only for multicolumn page
    • Missing jars in servlet
    • Optimise performance of PNG with alpha using raw loader
    • basic-link not navigating to corresponding footnote
    • Added option to sign PDF
    • Added secure processing for XSL input
    • Allow sections which need security permissions to be run when AllPermission denied in caller code
    • Remove unused PDFStructElem
    • Remove space generated by fo:wrapper
    • Reset content length for table changing ipd
    • Added alt text to PDF signature
    • Allow change of resource level for SVG in AFP
    • Exclude shape not in clipping path for AFP
    • Only support 1 column for redo of layout without page pos only
    • Switch to Jakarta servlet API
    • NPE when list item is split alongside an ipd change
    • Added mandatory MODCA triplet to AFP
    • Redo layout for multipage columns
    • Added image mask option for AFP
    • Skip written block ipds inside float
    • Allow curly braces for src url
    • Missing content for last page with change ipd
    • Added warning when different pdf languages are used
    • Only restart line manager when there is a linebreak for blocklayout

  • Version 2.9:

    • Values in PDF Number Trees must be indirect references
    • Do not delete files on syntax errors using command line
    • Surrogate pair edge-case causes Exception
    • Reset character spacing
    • SVG text containing certain glyphs isn't rendered
    • Remove duplicate classes from maven classpath
    • Allow use of page position only on redo of layout
    • Failure to render multi-block itemBody alongside float
    • Update to PDFBox 2.0.27
    • NPE if link destination is missing with accessibility
    • Make property cache thread safe
    • Font size was rounded to 0 for AFP TTF
    • Cannot process a SVG using mvn jars
    • Remove serializer jar
    • Allow creating a PDF 2.0 document
    • Text missing after page break inside table inline
    • IllegalArgumentException for list in a table
    • Table width may be too wide when layout width changes
    • NPE when using broken link and PDF 1.5
    • Allow XMP at PDF page level
    • Symbol font was not being mapped to unicode
    • Correct font differences table for Chrome
    • Link against Java 8 API
    • Added support for font-selection-strategy=character-by-character
    • Merge form fields in external PDFs
    • Fixed test for Java 11

xmlgraphics-batik was updated from version 1.17 to 1.18:

• PNG transcoder references nonexistent class
• Set offset to 0 if missing in stop tag
• Validate throws NPE
• Fixed missing arabic characters
• Animated rotate tranform ignores y-origin at exactly 270 degrees
• Set an automatic module name
• Ignore inkscape properties
• Switch to spotbugs
• Allow source and target resolution configuration

xmlgraphics-commons was updated from version 2.8 to 2.10:

• Fixed test for Java 11
• Allow XMP at PDF page level
• Allow source resolution configuration
• Added new schema to handle pdf/a and pdfa/ua
• Set an automatic module name
• Switch to spotbugs
• Do not use a singleton for ImageImplRegistry

javapackages-tools was updated from version 6.3.0 to 6.3.4:

• Version 6.3.4:

  • A…