UBUNTU-CVE-2017-5662

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2017-5662

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-5662.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-5662

Related

Published

2017-04-18T00:00:00Z

Modified

2024-10-15T14:06:15Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CVSS Calculator

Summary

[none]

Details

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

References

Affected packages

Ubuntu:14.04:LTS / batik

Package

Name: batik
Purl: pkg:deb/ubuntu/batik?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.ubuntu-8ubuntu2.14.04.2

Affected versions

1.*

1.7.ubuntu-8ubuntu2

1.7.ubuntu-8ubuntu2.14.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.7.ubuntu-8ubuntu2.14.04.2",
            "binary_name": "libbatik-java"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / batik

Package

Name: batik
Purl: pkg:deb/ubuntu/batik?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.7.ubuntu-8ubuntu3

1.8-3

1.8-3ubuntu1

1.8-3ubuntu1+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / batik

Package

Name: batik
Purl: pkg:deb/ubuntu/batik?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9-3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.9-3",
            "binary_name": "libbatik-java"
        }
    ]
}