NetSight
IP …
critical9.8

CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then …

Impact

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Affected products

VendorProductAffected versions
ApacheBatik
from 1.0 before 1.10
DebianDebian Linux
Versions 7.0, 8.0, 9.0
CanonicalUbuntu Linux
Version 14.04
OracleBusiness Intelligence
Versions 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Diameter Signaling Router
before 8.3
OracleCommunications Metasolv Solution
Version 6.3.0
OracleCommunications Webrtc Session Controller
before 7.2
OracleData Integrator
Version 12.2.1.3.0
OracleEnterprise Repository
Versions 11.1.1.7.0, 12.1.3.0.0
OracleFinancial Services Analytical Applications Infrastructure
from 7.3.3.0.0 through 7.3.3.0.2
from 8.0.0.0.0 through 8.0.7.1.0
OracleFusion Middleware Mapviewer
Versions 12.2.1.2, 12.2.1.3
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3

Weakness classification

CWE-502

References