Deserialization of untrusted data in Apache Batik - CVE-2018-8013

Vulnerability identifier: #VU13059

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8013

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to insufficient validation of user-supplied data. A remote attacker can supply specially crafted data, trigger a deserialization error in a subclass of 'AbstractDocuent' and access potentially sensitive information.

Apache Batik
Oracle Insurance Policy Administration
Oracle WebCenter Sites
Debian Linux
Gentoo Linux
Fedora
IBM Business Automation Workflow
Oracle Communications Application Session Controller
Oracle Communications Diameter Signaling Router (DSR)
IBM Intelligent Operations Center
Oracle Communications WebRTC Session Controller
IBM Cloud Application Performance Management (APM)
JD Edwards EnterpriseOne Tools
IBM Tivoli Network Manager (ITNM)
Oracle Insurance Calculation Engine
Oracle Retail Integration Bus
batik
dev-java/batik
IBM Case Manager
IBM Engineering Systems Design Rhapsody

Update to version 1.10.

batik - addressed in versions 1.10-1.fc27, 1.10-1.fc28
dev-java/batik - update to 1.17
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
IBM Intelligent Operations Center - update to 5.2.4
IBM Case Manager - update to 5.3.3-IF011
Oracle Communications WebRTC Session Controller - update to 7.2
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Engineering Systems Design Rhapsody - update to 9.0.1.0.5

• https://xmlgraphics.apache.org/security.html

• Information disclosure in Apache Batik
• Debian update for batik
• Multiple vulnerabilities in Oracle Insurance Applications
• Multiple vulnerabilities in Oracle Insurance Calculation Engine
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM Tivoli Network Manager (ITNM)
• Multiple vulnerabilities in IBM Business Automation Workflow and IBM Case Manager
• Gentoo update for Apache Batik
• Multiple vulnerabilities in IBM Application Performance Management
• Fedora 28 update for batik
• Fedora 27 update for batik
• Multiple vulnerabilities in Oracle Communications Application Session Controller
• Multiple vulnerabilities in Oracle WebCenter Sites
• Deserialization of untrusted data in Oracle Retail Integration Bus
• Deserialization of untrusted data in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in Oracle Insurance Policy Administration
• Multiple vulnerabilities in Oracle Communications WebRTC Session Controller
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)