CVE-2022-41704

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache XML Graphics	>= Batik, <= 1.15

References

http://www.openwall.com/lists/oss-security/2022/10/25/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xfVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-11
https://www.debian.org/security/2022/dsa-5264Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/25/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xfVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-11
https://www.debian.org/security/2022/dsa-5264Third Party Advisory

Timeline

Published: Oct 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-417059.8Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because th CVE-2022-417068.2Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application do CVE-2022-417076.5Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. T CVE-2022-417084.3Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of CVE-2022-417097.8Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdo CVE-2022-41717.5The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due CVE-2022-417105.5Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicio CVE-2022-417119.8Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because th CVE-2022-417126.5Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does n CVE-2022-417135.3deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the applicat CVE-2022-417145.3fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the applica CVE-2022-417157.5Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed re