{"id":"CVE-2017-5662","aliases":["CLSA-2026-1778633124","DEBIAN-CVE-2017-5662","DLA-926-1","DSA-4215-1","EUVD-2022-5045","GHSA-qwgx-59jw-qfg9","SUSE-SU-2024:0777-1","UBUNTU-CVE-2017-5662","USN-3280-1"],"status":"published","title":"Improper Restriction of XML External Entity Reference in Apache Batik","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04118,"percentile":0.90861,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2017-04-18T00:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","fixed_in":["1.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"batik","fixed_in":["1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"batik","fixed_in":["1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"batik","fixed_in":["1.9-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"batik","fixed_in":["1.7+dfsg-3+deb7u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"batik","fixed_in":["1.7.ubuntu-8ubuntu2.14.04.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-anim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-awt-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-css","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gui-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-gvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-rasterizer-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-slideshow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-squiggle-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svg-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svggen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-swing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-transcoder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-ttf2svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.xmlgraphics:batik-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.1"}]}],"versions":["1.7"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-3+deb7u2"}]}],"versions":["1.7+dfsg-3","1.7+dfsg-3+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7+dfsg-5+deb8u1"}]}],"versions":["1.7+dfsg-5"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-4+deb9u1"}]}],"versions":["1.8-4"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2.7.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.2"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.ubuntu-8ubuntu3","1.8-3","1.8-3ubuntu1","1.8-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.ubuntu-8ubuntu2.14.04.2"}]}],"versions":["1.7.ubuntu-8ubuntu2","1.7.ubuntu-8ubuntu2.14.04.1"]}],"products":[{"vendor":"apache","product":"batik"},{"vendor":"apache software foundation","product":"apache batik"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2547","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0319","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1038334","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://www.debian.org/security/2018/dsa-4215","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2546","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/97948","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://xmlgraphics.apache.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5662","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qwgx-59jw-qfg9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5662","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1034675","tags":["report"]},{"url":"https://bugzilla.suse.com/1172961","tags":["report"]},{"url":"https://bugzilla.suse.com/1182748","tags":["report"]},{"url":"https://bugzilla.suse.com/1203672","tags":["report"]},{"url":"https://bugzilla.suse.com/1203673","tags":["report"]},{"url":"https://bugzilla.suse.com/1203674","tags":["report"]},{"url":"https://bugzilla.suse.com/1204704","tags":["report"]},{"url":"https://bugzilla.suse.com/1204709","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44730","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5662","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/04/18/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3280-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5662","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5662","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2017-04-18T14:00:00Z","modified":"2024-08-05T15:11:47.301Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2022-5045","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2017-04-18T14:00:00Z","modified":"2024-08-05T15:11:47Z","updated_at":"2026-11-03T02:39:14.545495Z"}],"ghsa":[{"id":"GHSA-qwgx-59jw-qfg9","title":"Improper Restriction of XML External Entity Reference in Apache Batik","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2022-05-13T01:14:24Z","modified":"2023-01-27T05:02:09Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2017-5662","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2017-04-18T14:59:00.18Z","modified":"2026-06-17T01:20:59.4Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.9,"vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"CVE-2017-5662","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2017-04-18T14:59:00.18Z","modified":"2026-10-24T10:30:58.600965632Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5662","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2017-04-18T14:59:00.18Z","modified":"2026-09-01T20:03:48.634648855Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"GHSA-qwgx-59jw-qfg9","title":"Improper Restriction of XML External Entity Reference in Apache Batik","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2022-05-13T01:14:24Z","modified":"2023-11-08T03:59:23.164223Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2017-5662","description":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.","status":"published","published":"2017-04-18T00:00:00Z","modified":"2026-02-04T04:36:14.614536Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"CLSA-2026-1778633124","title":"TuxCare security update for org.apache.xmlgraphics (10 CVEs)","description":"TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.414053178Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-926-1","title":"batik - security update","status":"published","published":"2017-04-29T00:00:00Z","modified":"2026-03-09T02:10:32.744017Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-4215-1","title":"batik - security update","status":"published","published":"2018-06-02T00:00:00Z","modified":"2026-03-09T01:19:26.870554Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"SUSE-SU-2024:0777-1","title":"Security update for xmlgraphics-batik","description":"This update for xmlgraphics-batik fixes the following issues:\n\n- CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).\n- CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).\n- CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).\n- CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).\n- CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).\n- CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).\n- CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).\n- CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).\n- CVE-2022-44729: Fixed Server-Side Request Forgery.\n- CVE-2022-44730: Fixed Server-Side Request Forgery.\n\nUpgrade to version 1.17.\n","status":"published","published":"2024-03-06T11:54:24Z","modified":"2026-02-04T03:34:59.610627Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-3280-1","title":"batik vulnerability","description":"Lars Krapf and Pierre Ernst discovered that Apache Batik incorrectly\nhandled XML external entities. A remote attacker could possibly use this\nissue to obtain sensitive files from the filesystem, or cause a denial of\nservice.\n","status":"published","published":"2017-05-09T14:30:40Z","modified":"2026-04-27T15:14:55.31642Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}