Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc1NTYteDV2eC1xaDU5

Android SVG vulnerable to XML External Entity (XXE)

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution

Permalink: https://github.com/advisories/GHSA-g556-x5vx-qh59
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc1NTYteDV2eC1xaDU5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: over 1 year ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-g556-x5vx-qh59, CVE-2017-1000498
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000498
• https://github.com/BigBadaboom/androidsvg/issues/122
• https://github.com/advisories/GHSA-g556-x5vx-qh59

Repository: https://github.com/BigBadaboom/androidsvg
Blast Radius: 20.7

Affected Packages