Critical Vulnerability in Batik Package: Remote Code Execution via Untrusted SVG
Summary
UBUNTU-CVE-2022-42890: A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. Affects batik versions < 1.7.ubuntu-8ubuntu2.14.04.3+esm1. Fixed in 1.7.ubuntu-8ubuntu2.14.04.3+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Batik is an Apache XML Graphics project that provides a Java-based toolkit for processing SVG (Scalable Vector Graphics) files. It allows users to create, manipulate, and render SVG content. Batik is widely used in applications that require SVG support, making it a crucial component for developers working with graphics in Java. However, a vulnerability has been identified that could allow attackers to execute arbitrary Java code through untrusted SVG files, posing significant security risks.
Vulnerability Detail
A vulnerability in the Batik package allows an attacker to execute Java code from untrusted SVG files via JavaScript. This issue affects versions of Apache XML Graphics prior to 1.16. The vulnerability arises from improper handling of JavaScript within SVG files, which can lead to remote code execution. If exploited, this could allow an attacker to gain unauthorized access to the system, potentially leading to data breaches or system compromise.
How To Fix
Minimum fixed version
1.7.ubuntu-8ubuntu2.14.04.3+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade batikTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid processing untrusted SVG files until the package is updated. Additionally, consider implementing strict input validation to mitigate the risk of executing untrusted code.
Conclusion
The vulnerability in the Batik package poses a significant risk due to its potential for remote code execution through untrusted SVG files. Users are strongly encouraged to upgrade to the latest patched versions to mitigate this risk. For those unable to update immediately, implementing workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for batik →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of Batik prior to 1.16 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Some patched versions are available with Ubuntu Pro, while others do not require a subscription.
If you cannot update the package immediately, avoid processing untrusted SVG files and implement strict input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for batik.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.