Apache Tika allows Java code execution for serialized objects embedded in MATLAB files
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-6809US | critical9.8 | — | ||
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://seclists.org/bugtraq/2016/Nov/40WEB
- http://www.securityfocus.com/bid/94247WEB
- https://dist.apache.org/repos/dist/release/tika/CHANGES-1.14.txtWEB
- https://github.com/advisories/GHSA-j8g6-2wh7-6439ADVISORY
- https://github.com/apache/tikaPACKAGE
- https://github.com/apache/tika/commit/8a68b5d474205cc91cbbb610d4a1c05af57f0610WEB
- https://lists.apache.org/thread.html/91eb639ef619b9a26b40020ca6732e7dbe457f7322ed5f1df49e411a@%3Cdev.nutch.apache.org%3EWEB
- https://lists.apache.org/thread.html/d2375da29d89e679abf5d845db76d6f798fdc6f7d44f2c788e8a0fb9@%3Cuser.nutch.apache.org%3EWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan