High severity vulnerability that affects org.apache.pdfbox:pdfbox
High severity
GitHub Reviewed
Published
Oct 17, 2018
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Package
Affected versions
< 1.8.12
= 2.0.0
Patched versions
1.8.12
2.0.1
Description
Published to the GitHub Advisory Database
Oct 17, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 9, 2023
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
References