CVE-2016-2175 High severity vulnerability that affects org.apache.pdfbox:pdfbox
Attackers can exploit XML External Entity vulnerabilities in Apache PDFBox via crafted PDFs to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2175?
CVE-2016-2175 is a high-severity vulnerability in Debian Debian Linux, published on 1 Jun 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Which versions are affected by CVE-2016-2175?
4 open source packages ship an affected version, including org.apache.pdfbox:pdfbox. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.pdfbox:pdfbox Maven | All versions | 1.8.12 |
org.apache.pdfbox:pdfbox Maven | All versions | 1.8.12 |
org.apache.pdfbox:pdfbox Maven | From 2.0.0 | 2.0.1 |
org.apache.pdfbox:pdfbox Maven | From 2.0.0 | 2.0.1 |
Products include Apache Pdfbox, Debian Debian Linux.
How do I fix CVE-2016-2175?
Upgrade org.apache.pdfbox:pdfbox to a fixed version for your release line: 1.8.12 or 2.0.1.
Is CVE-2016-2175 being exploited?
There is no known exploitation of CVE-2016-2175 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2018-8036 Loop with Unreachable Exit Condition in Apache PDFBox
- CVE-2021-31811 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
- CVE-2021-31812 A carefully crafted PDF file can trigger an infinite loop while loading the file
- CVE-2021-27807 A carefully crafted PDF file can trigger an infinite loop while loading the file
- CVE-2021-27906 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file
Sources
Also known as DEBIAN-CVE-2016-2175, DLA-505-1, DSA-3606-1, GHSA-4c32-xmgj-2g98, MGASA-2016-0253, UBUNTU-CVE-2016-2175 and 1 more.