{"id":"CVE-2016-2175","aliases":["DEBIAN-CVE-2016-2175","DLA-505-1","DSA-3606-1","EUVD-2018-0498","GHSA-4c32-xmgj-2g98","MGASA-2016-0253","UBUNTU-CVE-2016-2175","openSUSE-SU-2024:10208-1"],"status":"published","title":"High severity vulnerability that affects org.apache.pdfbox:pdfbox","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0384,"percentile":0.90192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2016-06-01T20:00:00Z","modified":"2026-10-24T10:30:57Z","fixes":[{"ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","fixed_in":["1.8.12","2.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libpdfbox-java","fixed_in":["1:1.8.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpdfbox-java","fixed_in":["1:1.8.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpdfbox-java","fixed_in":["1:1.8.12-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libpdfbox-java","fixed_in":["1:1.7.0+dfsg-4+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libpdfbox-java","fixed_in":["1:1.8.7+dfsg-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"pdfbox","fixed_in":["1.8.7-1.1.mga5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.12-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0+dfsg-4+deb7u1"}]}],"versions":["1:1.7.0+dfsg-4"]},{"source":"osv","ecosystem":"Debian:8","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.7+dfsg-1+deb8u1"}]}],"versions":["1:1.8.7+dfsg-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12"}]}],"versions":["0.8.0-incubating","0.8.0-incubator","1.0.0","1.1.0","1.2.0","1.2.1","1.3.1","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.8.0","1.8.1","1.8.10","1.8.11","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.pdfbox:pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Mageia:5","package":"pdfbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libpdfbox-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.7+dfsg-1","1:1.8.10-1","1:1.8.10-2","1:1.8.11+dfsg-1"]}],"products":[{"vendor":"apache","product":"pdfbox"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0179.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3606","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/538503/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1739564","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.securityfocus.com/bid/90902","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1739565","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0272.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0248.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0249.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54%40%3Ccommits.tika.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2175","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4c32-xmgj-2g98","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54@%3Ccommits.tika.apache.org%3E","tags":["web"]},{"url":"http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8@apache.org%3E","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2175","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18558","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/27/1","tags":["web"]},{"url":"https://www.debian.org/security/2016/dsa-3606","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-2175","tags":["report"]},{"url":"http://seclists.org/oss-sec/2016/q2/419","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2175","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2175","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2175","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2016-06-01T20:00:00Z","modified":"2024-08-05T23:17:50.579Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2018-0498","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2016-06-01T20:00:00Z","modified":"2024-08-05T23:17:50Z","updated_at":"2026-11-03T02:22:54.125931Z"}],"ghsa":[{"id":"GHSA-4c32-xmgj-2g98","title":"High severity vulnerability that affects org.apache.pdfbox:pdfbox","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2018-10-17T18:22:15Z","modified":"2023-01-09T05:02:40Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:03.768255Z"}],"nvd":[{"id":"CVE-2016-2175","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2016-06-01T20:59:01.747Z","modified":"2026-06-17T00:43:35.237Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-2175","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2016-06-01T20:59:01.747Z","modified":"2026-10-24T10:30:57.276962688Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2175","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2016-06-01T20:59:01.747Z","modified":"2026-09-22T07:00:40.680145903Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-4c32-xmgj-2g98","title":"High severity vulnerability that affects org.apache.pdfbox:pdfbox","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2018-10-17T18:22:15Z","modified":"2023-11-08T03:58:24.099687Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"UBUNTU-CVE-2016-2175","description":"Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.","status":"published","published":"2016-06-01T20:59:00Z","modified":"2025-10-24T04:45:37Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DLA-505-1","title":"libpdfbox-java - security update","status":"published","published":"2016-06-06T00:00:00Z","modified":"2026-03-09T02:10:19.726598Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3606-1","title":"libpdfbox-java - security update","status":"published","published":"2016-06-24T00:00:00Z","modified":"2026-03-09T01:19:43.17176Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0253","title":"Updated pdfbox packages fix security vulnerability","description":"Apache PDFBox before 1.8.12 does not properly initialize the XML parsers,\nwhich allows context-dependent attackers to conduct XML External Entity\n(XXE) attacks via a crafted PDF (CVE-2016-2175).\n","status":"published","published":"2016-07-14T20:33:59Z","modified":"2026-04-16T06:22:21.250242566Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10208-1","title":"apache-pdfbox-1.8.12-1.6 on GA media","description":"These are all security issues fixed in the apache-pdfbox-1.8.12-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:08:25.265988Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}