Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Apache Batik Can Read Sensitive Files or Crash from Malicious SVGs

CVE-2015-0250 · published 11 years ago
Summary

Apache Batik, a software used to convert SVG files, has a security issue that can allow attackers to read sensitive files or cause the software to crash if it's given a specially crafted SVG file. This could potentially be exploited by hackers to access confidential information or disrupt the system. Update to Batik 1.8 or later to fix this issue.

What to do
  • Update apache org.apache.xmlgraphics:batik to version 1.8.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.xmlgraphics:batik >= 1.0, < 1.8
Fix: upgrade to 1.8
– canonical ubuntu_linux 12.04
14.04
14.10
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
– apache batik <= 1.7
cpe:2.3:a:apache:batik:*:*:*:*:*:*:*:*
– redhat jboss_enterprise_brms_platform <= 6.1.2
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*
Original advisory text
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of serv...
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
References
Severity
6.4 Medium
Exploitation
17% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published24 Mar 2015
Updated3 Oct 2026
First seen6 Mar 2026
Sources
GHSA-wfw6-mmmp-87xm · GHSA
CVE-2015-0250 · NVD
Track software like this
Free during beta