Описание
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libpdfbox-java | fixed | 1:1.8.12-1 | package |
Примечания
Fixed on upstream 1.8 branch in https://svn.apache.org/viewvc?view=revision&revision=1739564
Fixed on upstream 2.0 branch in https://svn.apache.org/viewvc?view=revision&revision=1739565
Связанные уязвимости
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
High severity vulnerability that affects org.apache.pdfbox:pdfbox
ALT-PU-2016-3317: package `pdfbox` update to version 1.8.12-alt1_1jpp8