CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

• apache batik (>= 1.0 < 1.10) • debian debian linux 7.0 • debian debian linux 8.0 • debian debian linux 9.0 • canonical ubuntu linux 14.04 • oracle business intelligence 11.1.1.7.0 • oracle business intelligence 11.1.1.9.0 • oracle business intelligence 12.2.1.3.0 • oracle business intelligence 12.2.1.4.0 • oracle communications diameter signaling router (< 8.3) • oracle communications metasolv solution 6.3.0 • oracle communications webrtc session controller (< 7.2) • oracle data integrator 12.2.1.3.0 • oracle enterprise repository 11.1.1.7.0 • oracle enterprise repository 12.1.3.0.0 • oracle financial services analytical applications infrastructure (>= 7.3.3.0.0 <= 7.3.3.0.2) • oracle financial services analytical applications infrastructure (>= 8.0.0.0.0 <= 8.0.7.1.0) • oracle fusion middleware mapviewer 12.2.1.2 • oracle fusion middleware mapviewer 12.2.1.3 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle insurance calculation engine 10.1.1 • oracle insurance calculation engine 10.2.1 • oracle insurance policy administration j2ee 10.0 • oracle insurance policy administration j2ee 10.2 • oracle jd edwards enterpriseone tools 9.2 • oracle retail back office 13.3 • oracle retail back office 13.4 • oracle retail back office 14 • oracle retail back office 14.1 • oracle retail central office 14.1 • oracle retail integration bus 17.0 • oracle retail order broker 5.1 • oracle retail order broker 5.2 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail point-of-service 13.4 • oracle retail point-of-service 14.0 • oracle retail point-of-service 14.1 • oracle retail returns management 14.1