CVE-2016-2175

Published: Jun 1, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Affected (17)

Products: Apache: Pdfbox · Debian: Debian Linux

1 product

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Apache Pdfbox	Version 1.8.0
Apache Pdfbox	Version 1.8.10
Apache Pdfbox	Version 1.8.11
Apache Pdfbox	Version 1.8.1
Apache Pdfbox	Version 1.8.2
Apache Pdfbox	Version 1.8.3
Apache Pdfbox	Version 1.8.4
Apache Pdfbox	Version 1.8.5
Apache Pdfbox	Version 1.8.6
Apache Pdfbox	Version 1.8.7
Apache Pdfbox	Version 1.8.8
Apache Pdfbox	Version 1.8.9
Apache Pdfbox	Version 2.0
Apache Pdfbox	Version 2.0 rc1
Apache Pdfbox	Version 2.0 rc2
Apache Pdfbox	Version 2.0 rc3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

References (24)

http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8%40apache.org%3E

Source: secalert@redhat.com

http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2017-0179.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2017-0248.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2017-0249.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2017-0272.html

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1739564

Source: secalert@redhat.com

PatchVendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=1739565

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2016/dsa-3606

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/538503/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/90902

Source: secalert@redhat.com

https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54%40%3Ccommits.tika.apache.org%3E

Source: secalert@redhat.com

http://mail-archives.us.apache.org/mod_mbox/www-announce/201605.mbox/%3C83a03bcf-f86b-4688-37b5-615c080291d8%40apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/137214/Apache-PDFBox-1.8.11-2.0.0-XML-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2017-0179.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2017-0248.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2017-0249.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2017-0272.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1739564

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=1739565

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.debian.org/security/2016/dsa-3606

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/archive/1/538503/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/90902

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/ad5fbc86c1d1821ae1b963e8561ab6d6a5f66b2848e84f5a31477f54%40%3Ccommits.tika.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.