XML injection (XXE) In org.apache.pdfbox:pdfbox
Description
High severity vulnerability that affects org.apache.pdfbox:pdfbox Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.8.12, 2.0.1 | ||
 debian 14 | 1:1.8.12-1 | ||
debian 12 | 1:1.8.12-1 | ||
debian 13 | 1:1.8.12-1 | ||
debian 11 | 1:1.8.12-1 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12.