CVE-2016-2175 High severity vulnerability that affects org.apache.pdfbox:pdfbox
HighCVSS 7.8
EPSS 3.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.pdfbox/pdfbox(Maven) | < 1.8.12 | 1.8.12 |
| org.apache.pdfbox/pdfbox(Maven) | = 2.0.0 | No fix listed |
| debian/libpdfbox-java(Debian:12) | < 1:1.8.12-1 | 1:1.8.12-1 |
| debian/libpdfbox-java(Debian:14) | < 1:1.8.12-1 | 1:1.8.12-1 |
| debian/libpdfbox-java(Debian:13) | < 1:1.8.12-1 | 1:1.8.12-1 |
| org.apache.pdfbox/pdfbox(Maven) | = 0.8.0-incubating | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 0.8.0-incubator | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.0.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.1.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.2.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.2.1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.3.1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.4.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.5.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.6.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.7.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.7.1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.0 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.1 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.10 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.11 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.2 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.3 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.4 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.5 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.6 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.7 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.8 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | = 1.8.9 | No fix listed |
| org.apache.pdfbox/pdfbox(Maven) | >= 2.0.0, < 2.0.1 | 2.0.1 |
| apache pdfbox | = 1.8.0 | No fix listed |
| apache pdfbox | = 1.8.1 | No fix listed |
| apache pdfbox | = 1.8.2 | No fix listed |
| apache pdfbox | = 1.8.3 | No fix listed |
| apache pdfbox | = 1.8.4 | No fix listed |
| apache pdfbox | = 1.8.5 | No fix listed |
| apache pdfbox | = 1.8.6 | No fix listed |
| apache pdfbox | = 1.8.7 | No fix listed |
| apache pdfbox | = 1.8.8 | No fix listed |
| apache pdfbox | = 1.8.9 | No fix listed |
| apache pdfbox | = 1.8.10 | No fix listed |
| apache pdfbox | = 1.8.11 | No fix listed |
| apache pdfbox | = 2.0 | No fix listed |
| apache pdfbox | = 2.0-rc1 | No fix listed |
| apache pdfbox | = 2.0-rc2 | No fix listed |
| apache pdfbox | = 2.0-rc3 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- mail-archives.us.apache.org
- packetstormsecurity.com exploit
- RHSA-2017:0179 vendor-advisory
- RHSA-2017:0248 vendor-advisory
- RHSA-2017:0249 vendor-advisory
- RHSA-2017:0272 vendor-advisory
- svn.apache.org patch vendor-advisory
- svn.apache.org patch vendor-advisory
- DSA-3606 third-party-advisory vendor-advisory
- 20160527 [CVE-2016-2175] Apache PDFBox XML External Entity vulnerability mailing-list
- 90902 vdb-entry
- Debian Security Tracker CVE-2016-2175 vendor-advisory
- [www-announce] 20160527 [CVE-2016-2175] Apache PDFBox XML External Entity vulnerability mailing-list
- [tika-commits] 20190802 svn commit: r1864259 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ... mailing-list