{
  "cveId": "CVE-2024-28168",
  "url": "https://patchblox.com/security/cve/CVE-2024-28168",
  "summary": "CVE-2024-28168 is fixed in 6 products on 1 platform, first by DEBIAN-CVE-2024-28168, released October 9, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "javapackages-tools: This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issue...",
  "description": "This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issues:\n\nxmlgraphics-fop was updated from version 2.8 to 2.10:\n \n- Security issues fixed:\n\n  * CVE-2024-28168: Fixed improper restriction of XML External Entity (XXE) reference (bsc#1231428)\n    \n- Upstream changes and bugs fixed:\n\n  * Version 2.10:\n\n    \u002B footnote-body ignores rl-tb writing mode\n    \u002B SVG tspan content is displayed out of place\n    \u002B Added new schema to handle pdf/a and pdfa/ua\n    \u002B Correct fop version at runtime\n    \u002B NoSuchElementException when using font with no family name\n    \u002B Resolve classpath for binary distribution\n    \u002B Switch to spotbugs\n    \u002B Set an automatic module name\n    \u002B Rename packages to avoid conflicts with modules\n    \u002B Resize table only for multicolumn page\n    \u002B Missing jars in servlet\n    \u002B Optimise performance of PNG with alpha using raw loader\n    \u002B basic-link not navigating to corresponding footnote\n    \u002B Added option to sign PDF\n    \u002B Added secure processing for XSL input\n    \u002B Allow sections which need security permissions to be run when AllPermission denied in caller code\n    \u002B Remove unused PDFStructElem\n    \u002B Remove space generated by fo:wrapper\n    \u002B Reset content length for table changing ipd\n    \u002B Added alt text to PDF signature\n    \u002B Allow change of resource level for SVG in AFP\n    \u002B Exclude shape not in clipping path for AFP\n    \u002B Only support 1 column for redo of layout without page pos only\n    \u002B Switch to Jakarta servlet API\n    \u002B NPE when list item is split alongside an ipd change\n    \u002B Added mandatory MODCA triplet to AFP\n    \u002B Redo layout for multipage columns\n    \u002B Added image mask option for AFP\n    \u002B Skip written block ipds inside float\n    \u002B Allow curly braces for src url\n    \u002B Missing content for last page with change ipd\n    \u002B Added warning when different pdf languages are used\n    \u002B Only restart line manager when there is a linebreak for blocklayout\n\n  * Version 2.9:\n\n    \u002B Values in PDF Number Trees must be indirect references\n    \u002B Do not delete files on syntax errors using command line\n    \u002B Surrogate pair edge-case causes Exception\n    \u002B Reset character spacing\n    \u002B SVG text containing certain glyphs isn\u0027t rendered\n    \u002B Remove duplicate classes from maven classpath\n    \u002B Allow use of page position only on redo of layout\n    \u002B Failure to render multi-block itemBody alongside float\n    \u002B Update to PDFBox 2.0.27\n    \u002B NPE if link destination is missing with accessibility\n    \u002B Make property cache thread safe\n    \u002B Font size was rounded to 0 for AFP TTF\n    \u002B Cannot process a SVG using mvn jars\n    \u002B Remove serializer jar\n    \u002B Allow creating a PDF 2.0 document\n    \u002B Text missing after page break inside table inline\n    \u002B IllegalArgumentException for list in a table\n    \u002B Table width may be too wide when layout width changes\n    \u002B NPE when using broken link and PDF 1.5\n    \u002B Allow XMP at PDF page level\n    \u002B Symbol font was not being mapped to unicode\n    \u002B Correct font differences table for Chrome\n    \u002B Link against Java 8 API\n    \u002B Added support for font-selection-strategy=character-by-character\n    \u002B Merge form fields in external PDFs\n    \u002B Fixed test for Java 11\n\nxmlgraphics-batik was updated from version 1.17 to 1.18:\n\n- PNG transcoder references nonexistent class\n- Set offset to 0 if missing in stop tag\n- Validate throws NPE\n- Fixed missing arabic characters\n- Animated rotate tranform ignores y-origin at exactly 270 degrees\n- Set an automatic module name\n- Ignore inkscape properties\n- Switch to spotbugs\n- Allow source and target resolution configuration\n\nxmlgraphics-commons was updated from version 2.8 to 2.10:\n\n- Fixed test for Java 11\n- Allow XMP at PDF page level\n- Allow source resolution configuration\n- Added new schema to handle pdf/a and pdfa/ua\n- Set an automatic module name\n- Switch to spotbugs\n- Do not use a singleton for ImageImplRegistry\n\njavapackages-tools was updated from version 6.3.0 to 6.3.4:\n\n- Version 6.3.4:\n\n  * A corner case when which is not present\n  * Remove dependency on which\n  * Simplify after the which -\u003E type -p change\n  * jpackage_script: Remove pointless assignment when %java_home is unset\n  * Don\u0027t export JAVA_HOME (bsc#1231347)\n\n- Version 6.3.2:\n\n  * Search for JAVACMD under JAVA_HOME only if it\u0027s set\n  * Obsolete set_jvm and set_jvm_dirs functions\n  * Drop unneeded _set_java_home function\n  * Remove JAVA_HOME check from check_java_env function\n  * Bump codecov/codecov-action from 2.0.2 to 4.6.0\n  * Bump actions/setup-python from 4 to 5\n  * Bump actions/checkout from 2 to 4\n  * Added custom dependabot config\n  * Remove the test for JAVA_HOME and error if it is not set\n  * java-functions: Remove unneeded local variables\n  * Fixed build status shield\n\n- Version 6.3.1:\n\n  * Allow missing components with abs2rel\n  * Fixed tests with python 3.4\n  * Sync spec file from Fedora\n  * Drop default JRE/JDK\n  * Fixed the use of java-functions in scripts\n  * Test that we don\u0027t bomb on \u003CrelativePath/\u003E\n  * Test variable expansion in artifactId\n  * Interpolate properties also in the current artifact\n  * Rewrite abs2rel in shell\n  * Use asciidoctor instead of asciidoc\n  * Fixed incompatibility with RPM 4.20\n  * Reproducible exclusions order in maven metadata\n  * Do not bomb on \u003CrelativePath/\u003E construct\n  * Make maven_depmap order of aliases reproducible",
  "published": "2024-10-09T12:15:02Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.01038,
  "epssPercentile": 0.64182,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "fop",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:2.10\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-28168",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-28168",
      "released": "2024-10-09T12:15:02Z"
    },
    {
      "platform": "linux",
      "product": "fop",
      "release": "Debian 14",
      "fixedVersion": "1:2.10\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-28168",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-28168",
      "released": "2024-10-09T12:15:02Z"
    },
    {
      "platform": "linux",
      "product": "javapackages-tools",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.3.4-150200.3.15.1",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "javapackages-tools",
      "release": "sles 15.6",
      "fixedVersion": "6.3.4-150200.3.15.1",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "javapackages-tools-extras",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.3.4-150200.3.15.1",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "javapackages-tools-extras",
      "release": "sles 15.6",
      "fixedVersion": "6.3.4-150200.3.15.1",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "xmlgraphics-batik",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.18-150200.4.10.2",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "xmlgraphics-batik",
      "release": "sles 15.6",
      "fixedVersion": "1.18-150200.4.10.2",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "xmlgraphics-commons",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.10-150200.3.10.2",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "xmlgraphics-commons",
      "release": "sles 15.6",
      "fixedVersion": "2.10-150200.3.10.2",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    },
    {
      "platform": "linux",
      "product": "xmlgraphics-fop",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.10-150200.13.10.1",
      "fix": "SUSE-SU-2024:4054-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4054-1",
      "released": "2024-11-26T05:05:51Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}