Test ID:	1.3.6.1.4.1.25623.1.1.1.2.2023.3619
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-3619-1)
Summary:	The remote host is missing an update for the Debian 'batik' package(s) announced via the DLA-3619-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'batik' package(s) announced via the DLA-3619-1 advisory. Vulnerability Insight: Batik is a toolkit for applications or applets that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulation. CVE-2020-11987 A server-side request forgery was found, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. CVE-2022-38398 A Server-Side Request Forgery (SSRF) vulnerability was found that allows an attacker to load a url thru the jar protocol. CVE-2022-38648 A Server-Side Request Forgery (SSRF) vulnerability was found that allows an attacker to fetch external resources. CVE-2022-40146 A Server-Side Request Forgery (SSRF) vulnerability was found that allows an attacker to access files using a Jar url. CVE-2022-44729 A Server-Side Request Forgery (SSRF) vulnerability was found. A malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. CVE-2022-44730 A Server-Side Request Forgery (SSRF) vulnerability was found. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. For Debian 10 buster, these problems have been fixed in version 1.10-2+deb10u3. We recommend that you upgrade your batik packages. For the detailed security status of batik please refer to its security tracker page at: [link moved to references] Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'batik' package(s) on Debian 10. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-11987 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/ https://security.gentoo.org/glsa/202401-11 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://www.oracle.com/security-alerts/cpuoct2021.html https://xmlgraphics.apache.org/security.html https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05@%3Cdev.poi.apache.org%3E https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2@%3Cdev.poi.apache.org%3E Common Vulnerability Exposure (CVE) ID: CVE-2022-38398 https://lists.apache.org/thread/712c9xwtmyghyokzrm2ml6sps4xlmbsx Common Vulnerability Exposure (CVE) ID: CVE-2022-38648 https://lists.apache.org/thread/gfsktxvj7jtwyovmhhbrw0bs13wfjd7b Common Vulnerability Exposure (CVE) ID: CVE-2022-40146 https://lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx Common Vulnerability Exposure (CVE) ID: CVE-2022-44729 https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 http://www.openwall.com/lists/oss-security/2023/08/22/4 http://www.openwall.com/lists/oss-security/2023/08/22/2 Common Vulnerability Exposure (CVE) ID: CVE-2022-44730 https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0 http://www.openwall.com/lists/oss-security/2023/08/22/5 http://www.openwall.com/lists/oss-security/2023/08/22/3
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.