ArchLinux: 201504-5: java-batik: xml external entity injection
Summary
Batik offers several classes for SVG to PNG/JPG conversion, which suffer from a XML External Entity Injection due to the evaluation of external entities within the given SVG file. If an application offers the possibility to upload a SVG file an attacker can put in a malicious formed file and retrieve sensitive information such as the content of files of the respective server. The type of file that can be retrieved depends on the user context in which the application is running.
Resolution
Upgrade to 1.8-1.
# pacman -Syu "java-batik>=1.8-1"
The problem has been fixed upstream in version 1.8.
References
https://seclists.org/fulldisclosure/2015/Mar/142 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0250 https://bugs.archlinux.org/task/44410
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.