CVE catalog

CVE-2017-5662

batik: CVE-2017-5662

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
4.12% · Oct 25, 2026

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbatiksid1.20-1fixed
Debianbatikforky1.19-2fixed
Debianbatiktrixie1.18+dfsg-2fixed
Debianbatikbookworm1.16+dfsg-1+deb12u1fixed
Ubuntubatik14.041.7.ubuntu-8ubuntu2vulnerable
Ubuntubatik14.041.7.ubuntu-8ubuntu2.14.04.1vulnerable
Ubuntubatik14.041.7.ubuntu-8ubuntu2.14.04.2fixed
Ubuntubatik14.041.7.ubuntu-8ubuntu2vulnerable
Ubuntubatik14.041.7.ubuntu-8ubuntu2.14.04.1vulnerable
Ubuntubatik14.041.7.ubuntu-8ubuntu2.14.04.2fixed
Ubuntubatikpro1.7.ubuntu-8ubuntu3vulnerable
Ubuntubatikpro1.8-3vulnerable
Ubuntubatikpro1.8-3ubuntu1vulnerable
Ubuntubatikpro1.8-3ubuntu1+esm1vulnerable
Susexmlgraphics-batiklinux enterprise software development kit 12 sp51.17-2.7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbatiksourcesid1.9-1not yet assignedNot reported[860566]
Debianbatiksourceforky1.9-1not yet assignedNot reported[860566]
Debianbatiksourcetrixie1.9-1not yet assignedNot reported[860566]
Debianbatiksourcebookworm1.9-1not yet assignedNot reported[860566]
Ubuntubatikdeb14.041.7.ubuntu-8ubuntu2.14.04.2Not reportedUSN-3280-1Not reported
Ubuntubatikdeb14.041.7.ubuntu-8ubuntu2.14.04.2Not reportedUBUNTU-CVE-2017-5662Not reported
Susexmlgraphics-batikrpmlinux enterprise software development kit 12 sp51.17-2.7.1Not reportedSUSE-SU-2024:0777-1Not reported

[Debian bug #860566]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libbatik-java]Fixed

    Source package: [batik]

    Details (2)

    • 1.16+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.9-1

      dsa · batik · debian · bookworm; dsa · batik · debian · 12

    • 1.16+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.9-1

      dsa · batik · debian · bookworm; dsa · batik · debian · 12

[Debian 13 (Trixie)]

  • [libbatik-java]Fixed

    Source package: [batik]

    Details (2)

    • 1.18+dfsg-2 · all · trixie

      Fixed · Fixed: 1.9-1

      dsa · batik · debian · 13

    • 1.18+dfsg-2 · all · trixie

      Fixed · Fixed: 1.9-1

      dsa · batik · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]