{"id":"CVE-2015-0250","aliases":["CLSA-2026-1778633124","DEBIAN-CVE-2015-0250","DLA-182-1","DSA-3205-1","EUVD-2022-5566","GHSA-wfw6-mmmp-87xm","MGASA-2015-0138","UBUNTU-CVE-2015-0250","USN-2548-1"],"status":"published","title":"Improper Input Validation in Apache Batik","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.16564,"percentile":0.97029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2015-03-18T00:00:00Z","modified":"2026-10-15T09:46:30Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","fixed_in":["1.8"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.7+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.7+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.7+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"batik","fixed_in":["1.7-6+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"batik","fixed_in":["1.7+dfsg-3+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"batik","fixed_in":["1.8-0.1.svn1230816.10.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"batik","fixed_in":["1.7.ubuntu-8ubuntu2.14.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-6+deb6u1"}]}],"versions":["1.7-6"]},{"source":"osv","ecosystem":"Debian:7","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-3+deb7u1"}]}],"versions":["1.7+dfsg-3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.8"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-0.1.svn1230816.10.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.1"}]}],"versions":["1.7.ubuntu-8ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.1"}]}],"versions":["1.7.ubuntu-8ubuntu2"]}],"products":[{"vendor":"apache","product":"batik"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2548-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","fix","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21963275","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:203","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2015/dsa-3205","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1032781","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2015-0138.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2015/Mar/142","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","evidence","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0042.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://xmlgraphics.apache.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0041.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0250","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wfw6-mmmp-87xm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0250","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0138.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15566","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/03/17/4","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2548-1/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-0250","tags":["report"]},{"url":"http://seclists.org/oss-sec/2015/q1/864","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2548-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0250","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-0250","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2015-03-24T17:00:00Z","modified":"2024-08-06T04:03:10.455Z","updated_at":"2026-11-02T14:35:45.428221Z"}],"euvd":[{"id":"EUVD-2022-5566","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2015-03-24T17:00:00Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.481932Z"}],"ghsa":[{"id":"GHSA-wfw6-mmmp-87xm","title":"Improper Input Validation in Apache Batik","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2022-05-17T00:28:34Z","modified":"2023-01-27T05:02:35Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2015-0250","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2015-03-24T17:59:00.07Z","modified":"2026-06-17T00:19:49.427Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CVE-2015-0250","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2015-03-24T17:59:00Z","modified":"2026-04-16T06:23:29.763636173Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0250","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2015-03-24T17:59:00.07Z","modified":"2026-09-09T06:47:32.737489721Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-182-1","title":"batik - security update","status":"published","published":"2015-03-27T00:00:00Z","modified":"2026-03-09T01:22:12.413144Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3205-1","title":"batik - security update","status":"published","published":"2015-03-27T00:00:00Z","modified":"2026-03-09T01:17:54.513658Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-wfw6-mmmp-87xm","title":"Improper Input Validation in Apache Batik","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2022-05-17T00:28:34Z","modified":"2023-11-08T03:57:48.044518Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"MGASA-2015-0138","title":"Updated batik packages fix security vulnerabilities","description":"Updated batik packages fix security vulnerability:\n\nNicolas Gregoire and Kevin Schaller discovered that Batik would load XML\nexternal entities by default. If a user or automated system were tricked into\nopening a specially crafted SVG file, an attacker could possibly obtain access\nto arbitrary files or cause resource consumption (CVE-2015-0250).\n","status":"published","published":"2015-04-09T22:44:14Z","modified":"2026-04-16T06:23:37.401659576Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2015-0250","description":"XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.","status":"published","published":"2015-03-18T00:00:00Z","modified":"2026-02-04T02:28:26.371856Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2548-1","title":"batik vulnerability","description":"Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML\nexternal entities by default. If a user or automated system were tricked\ninto opening a specially crafted SVG file, an attacker could possibly\nobtain access to arbitrary files or cause resource consumption.\n","status":"published","published":"2015-03-25T12:38:27Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}