CVE-2022-42890

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache XML Graphics	>= Batik, <= 1.15

References

http://www.openwall.com/lists/oss-security/2022/10/25/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwlyVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-11
https://www.debian.org/security/2022/dsa-5264Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/25/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwlyVendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-11
https://www.debian.org/security/2022/dsa-5264Third Party Advisory

Timeline

Published: Oct 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-428917.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-428925.3A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-428937.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-428947.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vul CVE-2022-428956.5There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to lea CVE-2022-428968.8There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions CVE-2022-428979.8Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and cont CVE-2022-428988.8PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution CVE-2022-428997.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issues when opening crafte CVE-2022-42908.8The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, an CVE-2022-429007.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files. Exploi CVE-2022-429017.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMT