CVE-2018-8013

NameCVE-2018-8013
DescriptionIn Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1385-1, DSA-4215-1
NVD severityhigh
Debian Bugs899374

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
batik (PTS)stretch1.8-4+deb9u2fixed
stretch (security)1.8-4+deb9u1fixed
buster1.10-2+deb10u1fixed
bullseye1.12-4fixed
bookworm, sid1.14-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
batiksourcewheezy1.7+dfsg-3+deb7u3DLA-1385-1
batiksourcejessie1.7+dfsg-5+deb8u1DSA-4215-1
batiksourcestretch1.8-4+deb9u1DSA-4215-1
batiksource(unstable)1.10-1899374

Notes

https://issues.apache.org/jira/browse/BATIK-1222
https://svn.apache.org/r1831241
https://marc.info/?l=oss-security&m=152707788503264&w=2

Search for package or bug name: Reporting problems