Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Multiple cases of Server-Side Request Forgery have been fixed in the Batik SVG toolkit for Java. For Debian 11 bullseye, these problems have been fixed in version . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4243-1
Change for system JDK from 17 to 21. upstream security release 122.0.6261.94 High CVE-2024-1938: Type Confusion in V8 High CVE-2024-1939: Type Confusion in V8 fixed bug with requires. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-129d8ca6fc 2024-03-07 22:24:39.963937 -------------------------------------------------------------------------------- Name : batik Product : Fedora 40 Version : 1.14 Release : 13.fc40 URL : https://xmlgraphics.apache.org/batik/ Summary : Scalable Vector Graphics for Java Description : Batik is a Java(tm) technology based toolkit for applications that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. -------------------------------------------------------------------------------- Update Information: Change for system JDK from 17 to 21. upstream security release 122.0.6261.94 High CVE-2024-1938: Type Confusion in V8 High CVE-2024-1939: Type Confusion in V8 fixed bug with requires Automatic update for lucene-9.9.2-1.fc40. bump java source/target to 1.8, fixes 2266639 -------------------------------------------------------------------------------- ChangeLog: * Sat Mar 2 2024 Jiri Vanek - 1.14-13 - Rebuilt for java-21-openjdk as system jdk * Tue Feb 27 2024 Jiri Vanek - 1.14-12 - Rebuilt for java-21-openjdk as system jdk -------------------------------------------------------------------------------- References: [ 1 ] Bug #2123726 - consoleImageViewer crashes at start https://bugzilla.redhat.com/show_bug.cgi?id=2123726 [ 2 ] Bug #2261062 - directory-maven-plugin: FTBFS in Fedora rawhide/f40 https://bugzilla.redhat.com/show_bug.cgi?id=2261062 [ 3 ] Bug #2266639 - directory-maven-plugin fails to build with java-21-openjdk https://bugzilla.redhat.com/show_bug.cgi?id=2266639 [ 4 ] Bug #2266934 - CVE-2024-1938 chromium: typeconfusion [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2266934 [ 5 ] Bug #2266937 - CVE-2024-1939 chromium: type confusion [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2266937 [ 6 ] Bug #2267486 - Include Java 21 as system Java Change in Fedora 40 Beta https://bugzilla.redhat.com/show_bug.cgi?id=2267486 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-129d8ca6fc' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Batik is a toolkit for applications or applets that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3619-1
Enforce minimal build as jython is orphaned. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-33a1b73e48 2021-04-16 14:33:16.807687 --------------------------------------------------------------------------------Name : batik Product : Fedora 33 Version : 1.14 Release : 2.fc33 URL : https://xmlgraphics.apache.org/batik/ Summary : Scalable Vector Graphics for Java Description : Batik is a Java(tm) technology based toolkit for applications that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. --------------------------------------------------------------------------------Update Information: Enforce minimal build as jython is orphaned --------------------------------------------------------------------------------ChangeLog: * Tue Mar 9 2021 Aleksandar Kurtakov - 1.14-2 - Enforce minimal build as jython is orphaned * Mon Mar 1 2021 Jie Kang - 1.14-1 - Update to latest upstream release * Tue Jan 26 2021 Fedora Release Engineering - 1.13-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1933808 - CVE-2020-11987 batik: SSRF due to improper input validation by the NodePickerPanel https://bugzilla.redhat.com/show_bug.cgi?id=1933808 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-33a1b73e48' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Updates to latest upstream release and fixes CVE-2020-11987. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-65ff5f10e2 2021-03-19 19:51:22.366547 --------------------------------------------------------------------------------Name : batik Product : Fedora 34 Version : 1.14 Release : 1.fc34 URL : https://xmlgraphics.apache.org/batik/ Summary : Scalable Vector Graphics for Java Description : Batik is a Java(tm) technology based toolkit for applications that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. --------------------------------------------------------------------------------Update Information: Updates to latest upstream release and fixes CVE-2020-11987 --------------------------------------------------------------------------------ChangeLog: * Mon Mar 1 2021 Jie Kang - 1.14-1 - Update to latest upstream release --------------------------------------------------------------------------------References: [ 1 ] Bug #1918540 - batik-1.14 is available https://bugzilla.redhat.com/show_bug.cgi?id=1918540 [ 2 ] Bug #1933809 - CVE-2020-11987 batik: SSRF due to improper input validation by the NodePickerPanel [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1933809 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-65ff5f10e2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Updates to the latest upstream release of Eclipse. See the upstream release notes for details: https://eclipseide.org/release/noteworthy/ Also contains security fixes for CVE-2019-17566 and CVE-2019-17638.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-cf8ef2f333 2020-08-31 15:48:37.485399 --------------------------------------------------------------------------------Name : batik Product : Fedora 32 Version : 1.13 Release : 1.fc32 URL : https://xmlgraphics.apache.org/batik/ Summary : Scalable Vector Graphics for Java Description : Batik is a Java(tm) technology based toolkit for applications that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. --------------------------------------------------------------------------------Update Information: Updates to the latest upstream release of Eclipse. See the upstream release notes for details: https://eclipseide.org/release/noteworthy/ Also contains security fixes for CVE-2019-17566 and CVE-2019-17638. --------------------------------------------------------------------------------ChangeLog: * Tue Aug 18 2020 Mat Booth - 1.13-1 - Update to latest upstream release - Add requirements on full JRE for subpackages that require AWT * Mon Jul 27 2020 Fedora Release Engineering - 1.11-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Fri Jul 10 2020 Jiri Vanek - 1.11-6 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 * Mon Jun 15 2020 Fedora Release Engineering - 1.11-4 - build with --xmvn-javadoc --------------------------------------------------------------------------------References: [ 1 ] Bug #1848617 - CVE-2019-17566 batik: SSRF via "xlink:href" https://bugzilla.redhat.com/show_bug.cgi?id=1848617 [ 2 ] Bug #1864680 - CVE-2019-17638 jetty: double release of resource can lead toinformation disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1864680 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-cf8ef2f333' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Security fix for CVE-2018-8013. Updated to upstream release 1.10.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-79792e0c64 2018-06-09 19:45:50.208252 --------------------------------------------------------------------------------Name : batik Product : Fedora 27 Version : 1.10 Release : 1.fc27 URL : https://xmlgraphics.apache.org/batik/ Summary : Scalable Vector Graphics for Java Description : Batik is a Java(tm) technology based toolkit for applications that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2018-8013. Updated to upstream release 1.10. --------------------------------------------------------------------------------ChangeLog: * Mon May 28 2018 Michael Simacek - 1.10-1 - Update to upstream version 1.10 - Use Recommends for jai-imageio-core (needed for TIFF support) * Wed Apr 25 2018 Mat Booth - 1.9-7 - Generate correct OSGi metadata * Wed Feb 7 2018 Fedora Release Engineering - 1.9-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1581725 - CVE-2018-8013 batik: information disclosure when deserializing https://bugzilla.redhat.com/show_bug.cgi?id=1581725 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-79792e0c64' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Man Yue Mo, Lars Krapf and Pierre Ernst discovered that Batik, a toolkit for processing SVG images, did not properly validate its input. This would allow an attacker to cause a denial-of-service, mount cross-site scripting attacks, or access restricted files on the . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4215-1
Get the latest Linux and open source security news straight to your inbox.