Ubuntu 2548-1: Advisory on Batik Resource Usage (CVE-2015-0250, Moderate)

ubuntu

March 25, 2015

Batik could be made to consume resources or expose sensitive information.

Summary

Batik could be made to consume resources or expose sensitive information.

Software Description:

- batik: xml.apache.org SVG Library

Details:

Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML

external entities by default. If a user or automated system were tricked

into opening a specially crafted SVG file, an attacker could possibly

obtain access to arbitrary files or cause resource consumption.

Topics Covered

security advisory security issue information exposure ubuntu resource consumption batik

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libbatik-java                   1.7.ubuntu-8ubuntu2.14.10.1

Ubuntu 14.04 LTS:
  libbatik-java                   1.7.ubuntu-8ubuntu2.14.04.1

Ubuntu 12.04 LTS:
  libbatik-java                   1.7.ubuntu-8ubuntu1.1

In general, a standard system update will make all the necessary changes.