CVE-2018-8013

NameCVE-2018-8013
DescriptionIn Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1385-1, DSA-4215-1
NVD severityhigh (attack range: remote)
Debian Bugs899374

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
batik (PTS)jessie (security), jessie1.7+dfsg-5+deb8u1fixed
stretch (security), stretch1.8-4+deb9u1fixed
bullseye, sid, buster1.10-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
batiksource(unstable)1.10-1high899374
batiksourcejessie1.7+dfsg-5+deb8u1highDSA-4215-1
batiksourcestretch1.8-4+deb9u1highDSA-4215-1
batiksourcewheezy1.7+dfsg-3+deb7u3highDLA-1385-1

Notes

https://issues.apache.org/jira/browse/BATIK-1222
https://svn.apache.org/viewvc?view=revision&revision=1831241
https://marc.info/?l=oss-security&m=152707788503264&w=2

Search for package or bug name: Reporting problems