CVE-2016-2175: XML External Entity (XXE) vulnerability in org.apache.pdfbox:pdfbox
Summary
CVE-2016-2175: High severity vulnerability that affects org.apache.pdfbox:pdfbox. Affects org.apache.pdfbox:pdfbox across 2 version ranges.
< 1.8.12
>= 2.0.0, < 2.0.1
Fixed in 1.8.12 or 2.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- libpdfbox-java · Debian:11
The same CVE-2016-2175 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.pdfbox:pdfbox is a Java library for working with PDF documents. It provides functionality for creating, manipulating, and extracting data from PDF files. This vulnerability affects versions before 1.8.12 and 2.x before 2.0.1 of the library. The vulnerability lies in the improper initialization of XML parsers, which allows attackers to exploit XML External Entity (XXE) attacks through crafted PDF files.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in org.apache.pdfbox:pdfbox allows context-dependent attackers to conduct attacks by exploiting the improper initialization of XML parsers. By crafting a malicious PDF file, an attacker can trigger the parsing of external entities, leading to various security risks. These risks include information disclosure, denial of service, and potential remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.121.8.12 -
>= 2.0.0, < 2.0.12.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the fixed versions mentioned above.
Conclusion
The XML External Entity (XXE) vulnerability in org.apache.pdfbox:pdfbox can be mitigated by updating to the fixed versions. It is important to promptly apply the recommended updates to ensure the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.pdfbox:pdfbox →
FAQ
org.apache.pdfbox:pdfbox is a Java library for working with PDF documents. It provides functionality for creating, manipulating, and extracting data from PDF files.
An XML External Entity (XXE) attack is a type of attack where an attacker exploits a vulnerability in an XML parser to access or manipulate external entities, leading to various security risks.
The potential risks of this vulnerability include information disclosure, denial of service, and potential remote code execution.
To fix this vulnerability, it is recommended to upgrade to version 1.8.12 or later for the 1.x branch, and version 2.0.1 or later for the 2.x branch of org.apache.pdfbox:pdfbox.
There is no known workaround for this vulnerability. It is strongly advised to update to the fixed versions mentioned above.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pdfbox:pdfbox.
