CVE-2022-42890

NameCVE-2022-42890
DescriptionA vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3169-1, DSA-5264-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
batik (PTS)buster1.10-2+deb10u1vulnerable
buster (security)1.10-2+deb10u2fixed
bullseye1.12-4vulnerable
bullseye (security)1.12-4+deb11u1fixed
bookworm, sid1.16+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
batiksourcebuster1.10-2+deb10u2DLA-3169-1
batiksourcebullseye1.12-4+deb11u1DSA-5264-1
batiksource(unstable)1.16+dfsg-1

Notes

https://www.openwall.com/lists/oss-security/2022/10/25/3
https://issues.apache.org/jira/browse/BATIK-1345
http://svn.apache.org/viewvc?view=revision&revision=1904549

Search for package or bug name: Reporting problems