GitHub Advisoryadvisory · Maven

GHSA-g556-x5vx-qh59 Android SVG vulnerable to XML External Entity (XXE)

HIGH Published 2018-10-19 Modified 2022-09-14 Official page ↗

Aliases: CVE-2017-1000498
Ecosystem: Maven
Packages: com.caverock:androidsvg
Severity: High
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-611
Reviewed: 2020-06-16

Affected packages

• Maven com.caverock:androidsvg: < 1.3 → fixed in 1.3

Description

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution

Related

Alias · CVE (1)

CVE-2017-1000498 AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code… vulnerability

Weakness · CWE (1)

CWE-611 Improper Restriction of XML External Entity Reference weakness

References