2018-05-24 18:29:00 2019-07-24 01:15:34

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL
Oracle Retail returns management 14.1 (not an official CPE) Oracle Retail point-of-service 14.0 (not an official CPE) Oracle Retail point-of-service 14.1 (not an official CPE) Apache Software Foundation Batik 1.0 Apache Software Foundation Batik 1.1 Apache Batik 1.1 Rc1 (not an official CPE) Apache Batik 1.1 Rc2 (not an official CPE) Apache Batik 1.1 Rc3 (not an official CPE) Apache Batik 1.1 Rc4 (not an official CPE) Apache Software Foundation Batik 1.1.1 Apache Software Foundation Batik 1.5 Apache Batik 1.5 Beta1 (not an official CPE) Apache Batik 1.5 Beta2 (not an official CPE) Apache Batik 1.5 Beta3 (not an official CPE) Apache Batik 1.5 Beta4 (not an official CPE) Apache Batik 1.5 Beta4b (not an official CPE) Apache Batik 1.5 Beta5 (not an official CPE) Apache Batik 1.5.1 (not an official CPE) Apache Batik 1.5.1 Rc2 (not an official CPE) Apache Batik 1.6 (not an official CPE) Oracle Insurance policy administration j2ee 10.0 (not an official CPE) Oracle Insurance policy administration j2ee 10.2 (not an official CPE) Oracle Jd edwards enterpriseone tools 9.2 (not an official CPE) Oracle Retail back office 13.3 (not an official CPE) Oracle Retail point-of-service 13.4 (not an official CPE) Oracle Retail order broker 16.0 (not an official CPE) Oracle Retail order broker 5.2 (not an official CPE) Oracle Retail order broker 15.0 (not an official CPE) Oracle Retail order broker 5.1 (not an official CPE) Oracle Retail integration bus 17.0 (not an official CPE) Oracle Retail central office 14.1 (not an official CPE) Oracle Retail back office 14.1 (not an official CPE) Oracle Retail back office 14 (not an official CPE) Oracle Retail back office 13.4 (not an official CPE) Oracle Insurance calculation engine 10.2.1 (not an official CPE) Oracle Insurance calculation engine 10.1.1 (not an official CPE) Oracle Instantis enterprisetrack 17.3 (not an official CPE) Oracle Instantis enterprisetrack 17.2 (not an official CPE) Oracle Instantis enterprisetrack 17.1 (not an official CPE) Oracle Fusion middleware mapviewer 12.2.1.3 (not an official CPE) Oracle Fusion middleware mapviewer 12.2.1.2 (not an official CPE) Oracle Financial services analytical applications infrastructure 8.0.5.0.0 (not an official CPE) Oracle Financial services analytical applications infrastructure 8.0.4.0.0 (not an official CPE) Oracle Business intelligence 11.1.1.7.0 ~~enterprise~~~ (not an official CPE) Oracle Business intelligence 11.1.1.9.0 ~~enterprise~~~ (not an official CPE) Apache Software Foundation Batik 1.7 Oracle Financial services analytical applications infrastructure 8.0.3.0.0 (not an official CPE) Oracle Financial services analytical applications infrastructure 8.0.2.0.0 (not an official CPE) Oracle Financial services analytical applications infrastructure 8.0.1.0.0 (not an official CPE) Oracle Financial services analytical applications infrastructure 8.0.0.0.0 (not an official CPE) Oracle Enterprise repository 12.1.3.0.0 (not an official CPE) Oracle Enterprise repository 11.1.1.7.0 (not an official CPE) Oracle Data integrator 12.2.1.3.0 (not an official CPE) Oracle Communications metasolv solution 6.3.0 (not an official CPE) Oracle Communications diameter signaling router 8.2 (not an official CPE) Oracle Communications diameter signaling router 8.1 (not an official CPE) Oracle Communications diameter signaling router 6.0 (not an official CPE) Oracle Business intelligence 12.2.1.4.0 ~~enterprise~~~ (not an official CPE) Oracle Business intelligence 12.2.1.3.0 ~~enterprise~~~ (not an official CPE) Apache Batik 1.7.1 (not an official CPE) Apache Batik 1.8 (not an official CPE) Apache Batik 1.9 (not an official CPE) Apache Batik 1.7 Beta1 (not an official CPE) Apache Batik 1.6.1 (not an official CPE) Apache Batik 1.9.1 (not an official CPE)