CVE-2016-2175
- Source
- https://cve.org/CVERecord?id=CVE-2016-2175
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2175.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2016-2175
- Aliases
- Downstream
- Related
- Published
- 2016-06-01T20:59:01Z
- Modified
- 2026-10-24T10:30:57Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:apache:pdfbox:2.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:apache:pdfbox:2.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:apache:pdfbox:2.0:rc3:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "2.0-rc1" }, { "last_affected": "2.0-rc1" }, { "introduced": "2.0-rc2" }, { "last_affected": "2.0-rc2" }, { "introduced": "2.0-rc3" }, { "last_affected": "2.0-rc3" } ], "source": "CPE_STRING" } ], "vendor_product": "apache:pdfbox" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "8.0" }, { "last_affected": "8.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" } ] }- References
-
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8%40apache.org%3E
- http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html
- http://www.securityfocus.com/archive/1/538503/100/0/threaded
- http://www.securityfocus.com/bid/90902
- https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54%40%3Ccommits.tika.apache.org%3E
- http://rhn.redhat.com/errata/RHSA-2017-0179.html
- http://rhn.redhat.com/errata/RHSA-2017-0248.html
- http://rhn.redhat.com/errata/RHSA-2017-0249.html
- http://rhn.redhat.com/errata/RHSA-2017-0272.html
- http://www.debian.org/security/2016/dsa-3606
- http://svn.apache.org/viewvc?view=revision&revision=1739564
- http://svn.apache.org/viewvc?view=revision&revision=1739565
Affected packages
Git / github.com/apache/pdfbox
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/pdfbox
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.0:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.0" }, { "last_affected": "1.8.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.1:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.1" }, { "last_affected": "1.8.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.2:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.2" }, { "last_affected": "1.8.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.3:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.3" }, { "last_affected": "1.8.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.4:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.4" }, { "last_affected": "1.8.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.5:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.5" }, { "last_affected": "1.8.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.6:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.6" }, { "last_affected": "1.8.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.7:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.7" }, { "last_affected": "1.8.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.8:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.8" }, { "last_affected": "1.8.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.9:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.9" }, { "last_affected": "1.8.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.10:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.10" }, { "last_affected": "1.8.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:1.8.11:*:*:*:*:*:*:*", "range": [ { "introduced": "1.8.11" }, { "last_affected": "1.8.11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:pdfbox:2.0:*:*:*:*:*:*:*", "range": [ { "introduced": "2.0" }, { "last_affected": "2.0" } ], "source": "CPE_STRING" } ] }