CVE-2016-6809

EUVD-2018-0628
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Affected Products (NVD)
VendorProductVersion
apachenutch
2.3.1
apachetika
𝑥
≤ 1.13
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tika
bullseye
1.22-2
fixed
jessie
not-affected
sid
1.22-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tika
precise
dne
trusty
dne
xenial
not-affected
yakkety
not-affected
References