CVE catalog

CVE-2022-42890

batik: CVE-2022-42890

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
3.36% · Oct 25, 2026

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbatiksid1.20-1fixed
Debianbatikforky1.19-2fixed
Debianbatiktrixie1.18+dfsg-2fixed
Debianbatikbookworm1.16+dfsg-1+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbatiksourcesid1.16+dfsg-1not yet assignedNot reportedNot reported
Debianbatiksourceforky1.16+dfsg-1not yet assignedNot reportedNot reported
Debianbatiksourcetrixie1.16+dfsg-1not yet assignedNot reportedNot reported
Debianbatiksourcebookworm1.16+dfsg-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libbatik-java]Fixed

    Source package: [batik]

    Details (2)

    • 1.16+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.16+dfsg-1

      dsa · batik · debian · bookworm

    • 1.16+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.16+dfsg-1

      dsa · batik · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]