{"id":"CVE-2024-28168","aliases":["DEBIAN-CVE-2024-28168","EUVD-2024-3073","GHSA-jqfv-jrvq-95jm","OESA-2024-2243","SUSE-SU-2024:4054-1","UBUNTU-CVE-2024-28168","openSUSE-SU-2024:14398-1"],"status":"published","title":"Apache XML Graphics FOP: XML External Entity (XXE) Processing","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01038,"percentile":0.6438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2024-10-09T12:04:03Z","modified":"2026-11-02T12:02:10Z","fixes":[{"ecosystem":"Maven","package":"org.apache.xmlgraphics:fop-core","fixed_in":["2.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"fop","fixed_in":["1:2.10+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fop","fixed_in":["1:2.10+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"fop","fixed_in":["2.2-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"fop","fixed_in":["2.2-9.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"fop","fixed_in":["2.2-9.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"fop","fixed_in":["2.2-9.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"fop","fixed_in":["2.2-9.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"javapackages-tools","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"javapackages-tools-extras","fixed_in":["6.3.4-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xmlgraphics-batik","fixed_in":["1.18-150200.4.10.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xmlgraphics-commons","fixed_in":["2.10-150200.3.10.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xmlgraphics-fop","fixed_in":["2.10-150200.13.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xmlgraphics-fop","fixed_in":["2.10-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlgraphics:fop-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9"},{"fixed":"2.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-1","1:2.10+dfsg-1~exp0","1:2.10+dfsg-1~exp1","1:2.10+dfsg-2","1:2.10+dfsg1-1","1:2.10+dfsg1-2","1:2.8-2","1:2.8-3"]},{"source":"osv","ecosystem":"Debian:13","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.10+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.10+dfsg-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlgraphics:fop-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10"}]}],"versions":["2.4","2.5","2.6","2.7","2.8","2.9"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-9.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-9.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-9.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-9.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"javapackages-tools-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xmlgraphics-batik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-150200.4.10.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xmlgraphics-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.3.10.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-150200.13.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.1.dfsg2-1ubuntu1","1:2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.1-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3-2","1:2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.5-3","1:2.6-1","1:2.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8-2","1:2.8-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-1","1:2.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xmlgraphics-fop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-1.1"}]}]}],"products":[{"vendor":"apache","product":"formatting_objects_processor"},{"vendor":"apache","product":"xml_graphics_fop"},{"vendor":"apache software foundation","product":"apache xml graphics fop"}],"references":[{"url":"https://xmlgraphics.apache.org/security.html","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/10/09/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28168","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-fop/commit/d96ba9a11710d02716b6f4f6107ebfa9ccec7134","tags":["web","report"]},{"url":"https://issues.apache.org/jira/browse/FOP-3168","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-jqfv-jrvq-95jm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28168.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28168","tags":["advisory"]},{"url":"https://github.com/apache/xmlgraphics-fop","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2243","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244054-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231347","tags":["report"]},{"url":"https://bugzilla.suse.com/1231428","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28168","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-28168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28168","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/10/09/1","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-28168","title":"Apache XML Graphics FOP: XML External Entity (XXE) Processing","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:04:03.835Z","modified":"2024-10-09T15:02:59.14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-3073","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:04:03Z","modified":"2024-10-09T15:02:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:43.39457Z"}],"ghsa":[{"id":"GHSA-jqfv-jrvq-95jm","title":"Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:30:52Z","modified":"2025-07-10T23:20:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2024-28168","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:15:02.85Z","modified":"2026-06-17T07:21:07.97Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:10:31.271525Z"}],"osv":[{"id":"CVE-2024-28168","title":"Apache XML Graphics FOP: XML External Entity (XXE) Processing","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:04:03.835Z","modified":"2026-10-28T02:30:30.344053387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"DEBIAN-CVE-2024-28168","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.  This issue affects Apache XML Graphics FOP: 2.9.  Users are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:15:02.85Z","modified":"2026-11-02T12:02:10.069821643Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-jqfv-jrvq-95jm","title":"Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.\n\nThis issue affects Apache XML Graphics FOP: 2.9.\n\nUsers are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:30:52Z","modified":"2025-07-11T00:12:16.162989Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"OESA-2024-2243","title":"fop security update","description":"FOP (Formatting Objects Processor) is a print formatter driven by XSL formatting objects (XSL-FO) and an output independent formatter. It is a Java application that reads a formatting object (FO) tree and renders the resulting pages to a specified output. Output formats currently supported include PDF, PS, PCL, AFP, XML (area tree representation), Print, AWT and PNG, and to a lesser extent, RTF and TXT. The primary output target is PDF.\r\n\r\nSecurity Fix(es):\r\n\r\nImproper Restriction of XML External Entity Reference (\u0026apos;XXE\u0026apos;) vulnerability in Apache XML Graphics FOP.\r\n\r\nThis issue affects Apache XML Graphics FOP: 2.9.\r\n\r\nUsers are recommended to upgrade to version 2.10, which fixes the issue.(CVE-2024-28168)","status":"published","published":"2024-10-12T11:07:43Z","modified":"2026-08-18T01:17:34.420581049Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-28168","description":"Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.","status":"published","published":"2024-10-09T12:15:00Z","modified":"2026-10-17T12:56:43.777103556Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"openSUSE-SU-2024:14398-1","title":"xmlgraphics-fop-2.10-1.1 on GA media","description":"These are all security issues fixed in the xmlgraphics-fop-2.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-13T00:00:00Z","modified":"2026-02-04T03:07:54.976497Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:4054-1","title":"Security update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop","description":"This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issues:\n\nxmlgraphics-fop was updated from version 2.8 to 2.10:\n \n- Security issues fixed:\n\n  * CVE-2024-28168: Fixed improper restriction of XML External Entity (XXE) reference (bsc#1231428)\n    \n- Upstream changes and bugs fixed:\n\n  * Version 2.10:\n\n    + footnote-body ignores rl-tb writing mode\n    + SVG tspan content is displayed out of place\n    + Added new schema to handle pdf/a and pdfa/ua\n    + Correct fop version at runtime\n    + NoSuchElementException when using font with no family name\n    + Resolve classpath for binary distribution\n    + Switch to spotbugs\n    + Set an automatic module name\n    + Rename packages to avoid conflicts with modules\n    + Resize table only for multicolumn page\n    + Missing jars in servlet\n    + Optimise performance of PNG with alpha using raw loader\n    + basic-link not navigating to corresponding footnote\n    + Added option to sign PDF\n    + Added secure processing for XSL input\n    + Allow sections which need security permissions to be run when AllPermission denied in caller code\n    + Remove unused PDFStructElem\n    + Remove space generated by fo:wrapper\n    + Reset content length for table changing ipd\n    + Added alt text to PDF signature\n    + Allow change of resource level for SVG in AFP\n    + Exclude shape not in clipping path for AFP\n    + Only support 1 column for redo of layout without page pos only\n    + Switch to Jakarta servlet API\n    + NPE when list item is split alongside an ipd change\n    + Added mandatory MODCA triplet to AFP\n    + Redo layout for multipage columns\n    + Added image mask option for AFP\n    + Skip written block ipds inside float\n    + Allow curly braces for src url\n    + Missing content for last page with change ipd\n    + Added warning when different pdf languages are used\n    + Only restart line manager when there is a linebreak for blocklayout\n\n  * Version 2.9:\n\n    + Values in PDF Number Trees must be indirect references\n    + Do not delete files on syntax errors using command line\n    + Surrogate pair edge-case causes Exception\n    + Reset character spacing\n    + SVG text containing certain glyphs isn't rendered\n    + Remove duplicate classes from maven classpath\n    + Allow use of page position only on redo of layout\n    + Failure to render multi-block itemBody alongside float\n    + Update to PDFBox 2.0.27\n    + NPE if link destination is missing with accessibility\n    + Make property cache thread safe\n    + Font size was rounded to 0 for AFP TTF\n    + Cannot process a SVG using mvn jars\n    + Remove serializer jar\n    + Allow creating a PDF 2.0 document\n    + Text missing after page break inside table inline\n    + IllegalArgumentException for list in a table\n    + Table width may be too wide when layout width changes\n    + NPE when using broken link and PDF 1.5\n    + Allow XMP at PDF page level\n    + Symbol font was not being mapped to unicode\n    + Correct font differences table for Chrome\n    + Link against Java 8 API\n    + Added support for font-selection-strategy=character-by-character\n    + Merge form fields in external PDFs\n    + Fixed test for Java 11\n\nxmlgraphics-batik was updated from version 1.17 to 1.18:\n\n- PNG transcoder references nonexistent class\n- Set offset to 0 if missing in stop tag\n- Validate throws NPE\n- Fixed missing arabic characters\n- Animated rotate tranform ignores y-origin at exactly 270 degrees\n- Set an automatic module name\n- Ignore inkscape properties\n- Switch to spotbugs\n- Allow source and target resolution configuration\n\nxmlgraphics-commons was updated from version 2.8 to 2.10:\n\n- Fixed test for Java 11\n- Allow XMP at PDF page level\n- Allow source resolution configuration\n- Added new schema to handle pdf/a and pdfa/ua\n- Set an automatic module name\n- Switch to spotbugs\n- Do not use a singleton for ImageImplRegistry\n\njavapackages-tools was updated from version 6.3.0 to 6.3.4:\n\n- Version 6.3.4:\n\n  * A corner case when which is not present\n  * Remove dependency on which\n  * Simplify after the which -\u003e type -p change\n  * jpackage_script: Remove pointless assignment when %java_home is unset\n  * Don't export JAVA_HOME (bsc#1231347)\n\n- Version 6.3.2:\n\n  * Search for JAVACMD under JAVA_HOME only if it's set\n  * Obsolete set_jvm and set_jvm_dirs functions\n  * Drop unneeded _set_java_home function\n  * Remove JAVA_HOME check from check_java_env function\n  * Bump codecov/codecov-action from 2.0.2 to 4.6.0\n  * Bump actions/setup-python from 4 to 5\n  * Bump actions/checkout from 2 to 4\n  * Added custom dependabot config\n  * Remove the test for JAVA_HOME and error if it is not set\n  * java-functions: Remove unneeded local variables\n  * Fixed build status shield\n\n- Version 6.3.1:\n\n  * Allow missing components with abs2rel\n  * Fixed tests with python 3.4\n  * Sync spec file from Fedora\n  * Drop default JRE/JDK\n  * Fixed the use of java-functions in scripts\n  * Test that we don't bomb on \u003crelativePath/\u003e\n  * Test variable expansion in artifactId\n  * Interpolate properties also in the current artifact\n  * Rewrite abs2rel in shell\n  * Use asciidoctor instead of asciidoc\n  * Fixed incompatibility with RPM 4.20\n  * Reproducible exclusions order in maven metadata\n  * Do not bomb on \u003crelativePath/\u003e construct\n  * Make maven_depmap order of aliases reproducible\n","status":"published","published":"2024-11-26T05:05:51Z","modified":"2026-02-04T02:19:55.907891Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}