High severity vulnerability that affects org.apache.pdfbox:pdfbox
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-2175US | high7.8 | — | ||
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks… | ||||
02
references
External citations — patches, advisories, analysis.
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8@apache.org%3EWEB
- http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2017-0179.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2017-0248.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2017-0249.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2017-0272.htmlWEB
- http://svn.apache.org/viewvc?view=revision&revision=1739564WEB
- http://svn.apache.org/viewvc?view=revision&revision=1739565WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan