SB2022103009 - Debian update for batik

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022103009

SB2022103009 - Debian update for batik

Published: October 30, 2022

Security Bulletin ID SB2022103009
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Code Injection (CVE-ID: CVE-2022-41704)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure processing links to .jar files inside .svg images. A remote attacker can upload a malicious .svg image that contains links to .jar files and execute arbitrary Java code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Code injection example:

<script type="application/java-archive" xlink:href="file.jar"/>


2) Code Injection (CVE-ID: CVE-2022-42890)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to the application allows running Java classes via JavaScript. A remote user can use JavaScript to execute a Java class on the system and obtain its execution results.

Example:

Runtime.getRuntime().exec("xxx");


Remediation

Install update from vendor's website.

References