Unscored severity · published Mar 24, 2015
CVE-2015-0250
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or…
–
CVSS
16.6%
EPSS
No
On KEV
Description
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Exploitation
Is it being used?
Exploit prediction (EPSS)16.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Batik · Apache
through 1.7 · source: NVD
JE
Jboss Enterprise Brms Platform · Redhat
through 6.1.2 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 14.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0250
advisories.mageia.org
http://advisories.mageia.org/MGASA-2015-0138.html
packetstormsecurity.com
http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0041.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0042.html
Exploit
http://seclists.org/fulldisclosure/2015/Mar/142
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21963275
More from Batik
9.8
CVE-2018-8013
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the…
8.2
CVE-2020-11987
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel
7.5
CVE-2022-41704
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
7.5
CVE-2022-42890
Apache Batik prior to 1.16 allows RCE via scripting
7.5
CVE-2022-40146
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url