CVE-2016-6809 Apache Tika allows Java code execution for serialized objects embedded in MATLAB files
CriticalCVSS 9.8
EPSS 8.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tika/tika-core(Maven) | < 1.14 | 1.14 |
| org.apache.tika/tika-core(Maven) | = 0.10 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 0.4 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 0.5 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 0.6 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 0.7 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 0.8 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 0.9 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.0 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.1 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.10 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.11 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.12 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.13 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.2 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.3 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.4 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.5 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.6 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.7 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.8 | No fix listed |
| org.apache.tika/tika-core(Maven) | = 1.9 | No fix listed |
| debian/tika(Debian:11) | < 1.18-1 | 1.18-1 |
| apache nutch | = 2.3.1 | No fix listed |
| apache tika | <= 1.13 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- dist.apache.org release-notes vendor-advisory
- github.com vendor-advisory
- github.com product
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- seclists.org mailing-list third-party-advisory vdb-entry
- 94247 third-party-advisory vdb-entry
- security-tracker.debian.org vendor-advisory
- [nutch-dev] 20191014 [SECURITY] Nutch 2.3.1 affected by downstream dependency CVE-2016-6809 mailing-list
- [nutch-user] 20191014 [SECURITY] Nutch 2.3.1 affected by downstream dependency CVE-2016-6809 mailing-list
- [lucene-dev] 20190325 Re: 6.6.6 Release mailing-list
- [lucene-issues] 20200815 [jira] [Commented] (SOLR-11486) CVE-2016-6809: Upgrade TIKA mailing-list
- [lucene-issues] 20200816 [jira] [Issue Comment Deleted] (SOLR-11486) CVE-2016-6809: Upgrade TIKA mailing-list