In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

The remote host is affected by the vulnerability described in GLSA-202401-11 (Apache Batik: Multiple Vulnerabilities)

  - In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a     string from the inputStream as the class name which then use it to call the no-arg constructor of the     class. Fix was to check the class type before calling newInstance in deserialization. (CVE-2018-8013)

  - Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the     xlink:href attributes. By using a specially-crafted argument, an attacker could exploit this     vulnerability to cause the underlying server to make arbitrary GET requests. (CVE-2019-17566)

  - Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the     NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to     cause the underlying server to make arbitrary GET requests. (CVE-2020-11987)

  - Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to     load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14. (CVE-2022-38398)

  - Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to     fetch external resources. This issue affects Apache XML Graphics Batik 1.14. (CVE-2022-38648)

  - Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to     access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14. (CVE-2022-40146)

  - A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG.
    This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
    (CVE-2022-41704)

  - A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via     JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to     version 1.16. (CVE-2022-42890)

  - Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics     Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger     loading external resources by default, causing resource consumption or in some cases even information     disclosure. Users are recommended to upgrade to version 1.17 or later. (CVE-2022-44729)

  - Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics     Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data     and send it directly as parameter to a URL. (CVE-2022-44730)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities :

  - A deserialization vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion Middleware     (subcomponent: Advanced UI (Apache Groovy)) due to a lack of isolation of object deserialization code. An     unauthenticated, remote attacker can exploit this, via HTTP, to execute arbitrary code on the target host.
    (CVE-2016-6814)

  - A remote code execution vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Apache Commons FileUpload)) due to an unspecified reason. An     unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.
    (CVE-2016-1000031)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Third Party Tools (Apache Batik)) due to an issue with deserialization. An     unauthenticated, remote attacker can exploit this issue, via HTTP, to cause the application to stop     functioning properly. (CVE-2018-8013)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Spring Framework)) due to an issue handling range requests with     a high number of ranges, wide ranges that overlap, or both. An unauthenticated, remote attacker can     exploit this issue, via HTTP, to cause the application to stop responding. (CVE-2018-15765)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.181016, 11.1.1.9.x prior to 11.1.1.9.181016, 12.2.1.3.x prior to 12.2.1.3.181016, or 12.2.1.4.x prior to 12.2.1.4.181016. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory:

  - A deserialization vulnerability exists in Apache Log4j     2.x before 2.8.2. An unauthenticated, remote attacker     can exploit this, via a specially crafted binary, to     execute arbitrary code on the target host     (CVE-2017-5645).

  - An information disclosure vulnerability exists in     Analytics Server, Oracle BI Publisher.Supported version     affected is 12.2.1.3.0 An unauthenticated, remote     attacker can exploit this, via HTTP, to disclose     potentially sensitive information. Successful attacks     require human interaction from a person other than the     attacker and while the vulnerability is in Oracle     Business Intelligence Enterprise Edition, attacks may     significantly impact additional products     (CVE-2018-3204).

  - A deserialization vulnerability exists in Apache Batik     1.x before 1.10 due to subclass of `AbstractDocument`.
    An unauthenticated, remote attacker can exploit this,     via deserializing subclass of `AbstractDocument`, to     execute arbitrary code on the target host     (CVE-2018-8013).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-8013. Updated to upstream release 1.10.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Man Yue Mo, Lars Krapf and Pierre Ernst discovered that Batik, a toolkit for processing SVG images, did not properly validate its input. This would allow an attacker to cause a denial-of-service, mount cross-site scripting attacks, or access restricted files on the server.

It was discovered that Batik incorrectly handled certain XML. An attacker could possibly use this to expose sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Man Yue Mo discovered a security vulnerability in Apache Batik, an SVG image library. A missing check for the class type before calling newInstance when deserializing a subclass of AbstractDocument could lead to information disclosure.

For Debian 7 'Wheezy', these problems have been fixed in version 1.7+dfsg-3+deb7u3.

We recommend that you upgrade your batik packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
187730	GLSA-202401-11 : Apache Batik: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
136091	Oracle WebCenter Sites Multiple Vulnerabilities (July 2019 CPU)	Nessus	Windows	critical
120948	Oracle Business Intelligence Publisher Multiple Vulnerabilities (October 2018 CPU)	Nessus	Misc.	critical
120250	Fedora 28 : batik (2018-168af81706)	Nessus	Fedora Local Security Checks	critical
110427	Fedora 27 : batik (2018-79792e0c64)	Nessus	Fedora Local Security Checks	critical
110316	Debian DSA-4215-1 : batik - security update	Nessus	Debian Local Security Checks	critical
110225	Ubuntu 14.04 LTS : Batik vulnerability (USN-3661-1)	Nessus	Ubuntu Local Security Checks	critical
110161	Debian DLA-1385-1 : batik security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-8013

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical