Information Exposure Affecting org.apache.xmlgraphics:batik-dom Open this link in a new tab package, versions [,1.10)


0.0
critical
  • Attack Complexity

    Low

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGAPACHEXMLGRAPHICS-32304

  • published

    24 May 2018

  • disclosed

    23 May 2018

  • credit

    Man Yue Mo

How to fix?

Upgrade org.apache.xmlgraphics:batik-dom to version 1.10 or higher.

Overview

org.apache.xmlgraphics:batik-dom is a Java-based toolkit for applications or applets that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as display, generation or manipulation.

Affected versions of this package are vulnerable to Information Exposure during deserialization. When deserializing a subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class.