Advisories » MGASA-2016-0253

Updated pdfbox packages fix security vulnerability

Publication date: 14 Jul 2016
Modification date: 14 Jul 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-2175

Description

Apache PDFBox before 1.8.12 does not properly initialize the XML parsers,
which allows context-dependent attackers to conduct XML External Entity
(XXE) attacks via a crafted PDF (CVE-2016-2175).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=18558
• http://www.openwall.com/lists/oss-security/2016/05/27/1
• https://www.debian.org/security/2016/dsa-3606
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2175

SRPMS

5/core

• pdfbox-1.8.7-1.1.mga5