imPC@ndo IT

Tracker / CVE-2018-8013

CVE-2018-8013

Critical 9.8

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Affected products and versions

apache batik · 1.0 → 1.10
canonical ubuntu_linux
debian debian_linux
oracle business_intelligence
oracle communications_diameter_signaling_router · … → 8.3
oracle communications_metasolv_solution
oracle communications_webrtc_session_controller · … → 7.2
oracle data_integrator
oracle enterprise_repository
oracle financial_services_analytical_applications_infrastructure · 7.3.3.0.0 → 7.3.3.0.2
oracle financial_services_analytical_applications_infrastructure · 8.0.0.0.0 → 8.0.7.1.0
oracle fusion_middleware_mapviewer
oracle instantis_enterprisetrack
oracle insurance_calculation_engine
oracle insurance_policy_administration_j2ee
oracle jd_edwards_enterpriseone_tools
oracle retail_back_office
oracle retail_central_office
oracle retail_integration_bus
oracle retail_order_broker
oracle retail_point-of-service
oracle retail_returns_management

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References