What’s Vulnerable › Vulnerabilities

CVE-2018-8013

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-24 · updated 2026-06-17
• Weakness: CWE-502

Description

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Affected products

• Apache Software Foundation Apache Batik: from 1.0 before 1.10 — fixed in 1.10
• Canonical Ubuntu Linux: 14.04
• Debian Linux: 7.0, 8.0, 9.0
• Oracle Corporation Oracle Business Intelligence Enterprise Edition: 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
• Oracle Communications Metasolv Solution: 6.3.0
• Oracle Corporation Communications WebRTC Session Controller: before 7.2 — fixed in 7.2
• Oracle Corporation Oracle Data Integrator: 12.2.1.3.0
• Oracle Corporation Enterprise Repository: 11.1.1.7.0, 12.1.3.0.0
• Oracle Corporation Financial Services Analytical Applications Infrastructure: from 7.3.3.0.0 through 7.3.3.0.2; from 8.0.0.0.0 through 8.0.7.1.0
• Oracle Corporation Fusion Middleware MapViewer: 12.2.1.2, 12.2.1.3
• Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
• Oracle Insurance Calculation Engine: 10.1.1, 10.2.1
• Oracle Insurance Policy Administration J2Ee: 10.0, 10.2
• Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
• Oracle Corporation Retail Back Office: 13.3, 13.4, 14, 14.1
• Oracle Corporation Retail Central Office: 14.1
• Oracle Corporation Oracle Retail Integration Bus: 17.0
• Oracle Retail Order Broker: 5.1, 5.2, 15.0, 16.0
• Oracle Corporation Retail Point-of-Service: 13.4, 14.0, 14.1
• Oracle Corporation Retail Returns Management: 14.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Batik 1.10; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Corporation Communications WebRTC Session Controller 7.2. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/104252
• http://www.securitytracker.com/id/1040995
• https://lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08126ee44%40%3Ccommits.xmlgraphics.apache.org%3E
• https://lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8d0fab19%40%3Ccommits.xmlgraphics.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2018/05/msg00016.html
• https://mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/%3c000701d3f28f%24d01860a0%24704921e0%24%40gmail.com%3e
• https://security.gentoo.org/glsa/202401-11
• https://usn.ubuntu.com/3661-1/
• https://www.debian.org/security/2018/dsa-4215
• https://www.oracle.com/security-alerts/cpujul2020.html

Get alerted when CVE-2018-8013 or the next vulnerability affects your stack