CVE-2022-42890

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Score

CVSS 3.1 7.5 High

Status

Modified - security@apache.org

Published

2022-10-25

Last modified

2024-08-03

Weaknesses

CWE-918

Affected products

• Batik (Apache)
• Apache Xml Graphics (Apache Software Foundation)
• Debian Linux (Debian)

References

• http://www.openwall.com/lists/oss-security/2022/10/25/3
• https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly
• https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html
• https://security.gentoo.org/glsa/202401-11
• https://www.debian.org/security/2022/dsa-5264