Improper Restriction of XML External Entity Reference in Apache FOP - CVE-2017-5661

Vulnerability identifier: #VU6634

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-5661

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform an XXE attack.

The vulnerability exists due to insufficient validation of user-supplied data when processing SVG files. A remote attacker can create a specially crafted SVG file, trick the victim into opening it with affected application and gain access to potentially sensitive information.

Successful exploitation of the vulnerability may lead to system compromise.

Apache FOP
Debian Linux
Arch Linux
Ubuntu
IBM Intelligent Operations Center
Tenable.sc

Update to version 2.2.

Apache FOP - update to 2.2
IBM Intelligent Operations Center - update to 5.2.4
Tenable.sc - update to 5.19.0

• https://xmlgraphics.apache.org/security.html

• Arch Linux update for Apache FOP
• XXE in Apache FOP
• Debian update for Apache FOP
• Ubuntu update for Apache Fop
• Multiple vulnerabilities in Tenable.sc
• Improper restriction of XML external entity reference in IBM Intelligent Operations Center