{
"id": "GHSA-4c32-xmgj-2g98",
"aliases": [
"CVE-2016-2175"
],
"details": "Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.",
"summary": "High severity vulnerability that affects org.apache.pdfbox:pdfbox",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.12"
}
]
}
],
"package": {
"name": "org.apache.pdfbox:pdfbox",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.1"
}
]
}
],
"package": {
"name": "org.apache.pdfbox:pdfbox",
"ecosystem": "Maven"
},
"versions": [
"2.0.0"
]
}
],
"modified": "2021-09-01T14:11:59Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"published": "2018-10-17T18:22:15Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2175",
"type": "ADVISORY"
},
{
"url": "https://github.com/advisories/GHSA-4c32-xmgj-2g98",
"type": "ADVISORY"
},
{
"url": "https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54@%3Ccommits.tika.apache.org%3E",
"type": "WEB"
},
{
"url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%[email protected] %3E",
"type": "WEB"
},
{
"url": "http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html",
"type": "WEB"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2017-0179.html",
"type": "WEB"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2017-0248.html",
"type": "WEB"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2017-0249.html",
"type": "WEB"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html",
"type": "WEB"
},
{
"url": "http://svn.apache.org/viewvc?view=revision&revision=1739564",
"type": "WEB"
},
{
"url": "http://svn.apache.org/viewvc?view=revision&revision=1739565",
"type": "WEB"
},
{
"url": "http://www.debian.org/security/2016/dsa-3606",
"type": "WEB"
},
{
"url": "http://www.securityfocus.com/archive/1/538503/100/0/threaded",
"type": "WEB"
},
{
"url": "http://www.securityfocus.com/bid/90902",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T20:58:03Z"
}
}