CVE-2015-0250

mediumPriorität · verfolgen · 32EPSS 0.166 · 97. PerzentilDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

16.6% (97th) EPSS

CVSS 6.4 · medium

Is it mine?

11 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · bewertet 2026-10-23

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenRed Hat JBoss BRMS 6.1redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so forth. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:0041
BehobenRed Hat JBoss BPMS 6.1redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2016:0042

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 4.9

v2.05.4mediumAV:N/AC:L/Au:N/C:P/I:N/A:P/E:Usecondary · CVSS-BT (t0sche)

v2.05.8mediumAV:N/AC:M/Au:N/C:P/I:N/A:Psecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-611US

betroffene Produkte (11)

Betroffene Produkte und Versionsbereiche.

IBM Tivoli Network Manager 4.2.0alle Versionencert_bundDEcpe:/a:ibm:tivoli_network_manager:4.2.0
IBM Tivoli Network Manager <= 4.2.0.15alle Versionencert_bundDEcpe:/a:ibm:tivoli_network_manager:4.2.0.15
n/a n/a≤ n/aenisa_euvdEU
apache batik≤ 1.7nvdUScpe:2.3:a:apache:batik:*:*:*:*:*:*:*:*
canonical ubuntu linux= 12.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 14.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 14.10nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
redhat jboss enterprise brms platform≤ 6.1.2nvdUScpe:2.3:a:redhat:jboss_enterprise_brms_platform:*:*:*:*:*:*:*:*
Maven org.apache.xmlgraphics:batik1.0 → 1.8osvUSpkg:maven/org.apache.xmlgraphics/batik
Red Hat JBoss BPMS 6.1alle Versionenfixedredhat_csafUScpe:/a:redhat:jboss_bpms:6.1
Red Hat JBoss BRMS 6.1alle Versionenfixedredhat_csafUScpe:/a:redhat:jboss_brms:6.1

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2016:0041Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.5 update2016-01-14csaf · redhat_csafUS
Red Hat JBoss BRMS 6.1.5, which fixes one security issue, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
RHSA-2016:0042Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.5 update2016-01-14csaf · redhat_csafUS
Red Hat JBoss BPM Suite 6.1.5, which fixes one security issue, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
WID-SEC-W-2023-0027IBM Tivoli Network Manager: Mehrere SchwachstellenDeutsch2023-01-04csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und nicht spezifizierte Auswirkungen zu verursachen.
GHSA-wfw6-mmmp-87xmImproper Input Validation in Apache Batik2022-05-17ghsa · osvUS
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund nvd osv redhat_csaf NVD CVE.org MITRE

veröffentlicht 2015-03-24geändert 2026-06-17

Referenzen (24)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan