[SECURITY] [DLA 182-1] batik security update

2015-03-2721:16:06

lists.debian.org

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

8.8 High

AI Score

Confidence

High

0.043 Low

EPSS

Percentile

92.3%

JSON

Package : batik
Version : 1.7-6+deb6u1
CVE ID : CVE-2015-0250
Debian Bug : 780897

Nicolas Gregoire and Kevin Schaller discovered that Batik, a toolkit
for processing SVG images, would load XML external entities by
default. If a user or automated system were tricked into opening a
specially crafted SVG file, an attacker could possibly obtain access
to arbitrary files or cause resource consumption.

OSVersionArchitecturePackageVersionFilename
Debian7allbatik< 1.7+dfsg-3+deb7u1batik_1.7+dfsg-3+deb7u1_all.deb
Debian7alllibbatik-java< 1.7+dfsg-3+deb7u1libbatik-java_1.7+dfsg-3+deb7u1_all.deb
Debian6allbatik< 1.7-6+deb6u1batik_1.7-6+deb6u1_all.deb
Debian6alllibbatik-java< 1.7-6+deb6u1libbatik-java_1.7-6+deb6u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	batik	< 1.7+dfsg-3+deb7u1	batik_1.7+dfsg-3+deb7u1_all.deb
Debian	7	all	libbatik-java	< 1.7+dfsg-3+deb7u1	libbatik-java_1.7+dfsg-3+deb7u1_all.deb
Debian	6	all	batik	< 1.7-6+deb6u1	batik_1.7-6+deb6u1_all.deb
Debian	6	all	libbatik-java	< 1.7-6+deb6u1	libbatik-java_1.7-6+deb6u1_all.deb