DSA-5264: -1 batik -- security update

Published Oct 29, 2022

Updated

batik - security update

Other sources

It was discovered that Apache Batik, a SVG library for Java, allowed attackers to run arbitrary Java code by processing a malicious SVG file.

Affected Software

2 affected components

debian/batik

Event History

Oct 29, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Debian batik package are exposed when they process SVG files that may be malicious. The issue affects Apache Batik, a Java SVG library.

What does an attacker need to exploit it?

An attacker needs a malicious SVG file to be processed by the affected library. Successful exploitation can allow arbitrary Java code to run.

How can I tell whether this advisory applies to my environment?

Check whether the Debian batik package is installed and whether applications on the system use it to process SVG content. The advisory references CVE-2022-41704 and CVE-2022-42890.

DSA-5264: -1 batik -- security update

Other sources

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether this advisory applies to my environment?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether this advisory applies to my environment?