Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability

Bugtraq ID:	97948
Class:	Design Error
CVE:	CVE-2017-5662
Remote:	Yes
Local:	No
Published:	Apr 18 2017 12:00AM
Updated:	Apr 19 2018 03:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Oracle Instantis EnterpriseTrack 17.2 Oracle Instantis EnterpriseTrack 17.1 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.1 Oracle Financial Services Analytical Applications Infrastructure 8.0 Oracle Financial Services Analytical Applications Infrastructure 7.3.5 Oracle Financial Services Analytical Applications Infrastructure 7.3.4 Oracle Financial Services Analytical Applications Infrastructure 7.3.3 Oracle Financial Services Analytical Applications Infrastructure 7.3.2 Oracle Financial Services Analytical Applications Infrastructure 7.3.1 Oracle Financial Services Analytical Applications Infrastructure 7.3 Oracle Enterprise Repository 12.1.3.0.0 Oracle Enterprise Repository 11.1.1.7.0 Oracle Communications MetaSolv Solution 6.3 Oracle Business Intelligence Enterprise Edition 12.2.1.3.0 Oracle Business Intelligence Enterprise Edition 12.2.1.2.0 Oracle Business Intelligence Enterprise Edition 11.1.1.9.0 Oracle Business Intelligence Enterprise Edition 11.1.1.7.0 Apache Batik 1.8 Apache Batik 1.7 Apache Batik 1.6 Apache Batik 1.5.1 Apache Batik 1.5 Apache Batik 1.1.1 Apache Batik 1.1 Apache Batik 1.0
Not Vulnerable:	Apache Batik 1.9

Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability

Apache Batik is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

Apache Batik 1.8 and prior versions are vulnerable.

Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability

References:

• Apache Homepage (Apache)
  
• Oracle Critical Patch Update Advisory - April 2018 (Oracle)
  
• The Apache XML Graphics Project - Security (Apache)