Register | Log in

batik

Apache Batik SVG Toolkit (tools)

Choose email to subscribe with

general

source: batik (main)
version: 1.20-1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Wolfgang Baer (DMD) – Pierre Gruet (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.12-4+deb11u2
o-o-sec: 1.12-4+deb11u3
oldstable: 1.16+dfsg-1+deb12u1
stable: 1.18+dfsg-2
testing: 1.20-1
unstable: 1.20-1

versioned links

1.12-4+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.12-4+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16+dfsg-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.18+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.20-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

batik
libbatik-java

action needed

6 security issues in trixie high

There are 6 open security issues in trixie.

6 important issues:

CVE-2026-40853: A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-44929: Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-49236: Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-89326: Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-90993: XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-111792: Uncontrolled Recursion vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Created: 2026-11-12 Last update: 2026-11-12 16:00

6 security issues in bookworm high

There are 6 open security issues in bookworm.

6 important issues:

CVE-2026-40853: A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-44929: Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-49236: Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-89326: Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-90993: XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
CVE-2026-111792: Uncontrolled Recursion vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

Created: 2026-11-12 Last update: 2026-11-12 16:00

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-28 Last update: 2026-10-28 04:31

news

[2026-11-01] batik 1.20-1 MIGRATED to testing (Debian testing watch)
[2026-10-26] Accepted batik 1.20-1 (source) into unstable (Emmanuel Bourg)
[2026-04-25] batik 1.19-2 MIGRATED to testing (Debian testing watch)
[2026-04-19] Accepted batik 1.19-2 (source) into unstable (Pierre Gruet)
[2026-03-16] Accepted batik 1.19-1 (source all) into unstable (Debian FTP Masters) (signed by: Emmanuel Bourg)
[2025-07-20] Accepted batik 1.12-4+deb11u3 (source) into oldstable-security (Adrian Bunk)
[2024-11-04] batik 1.18+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-10-30] Accepted batik 1.18+dfsg-2 (source) into unstable (Pierre Gruet)
[2024-10-28] Accepted batik 1.18+dfsg-1 (source) into unstable (Pierre Gruet)
[2023-10-14] Accepted batik 1.10-2+deb10u3 (source) into oldoldstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2023-09-25] Accepted batik 1.12-4+deb11u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Pierre Gruet)
[2023-09-25] Accepted batik 1.16+dfsg-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Pierre Gruet)
[2023-08-29] batik 1.17+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-08-24] Accepted batik 1.17+dfsg-1 (source) into unstable (Pierre Gruet)
[2022-11-05] Accepted batik 1.12-4+deb11u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2022-11-02] batik 1.16+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-10-29] Accepted batik 1.12-4+deb11u1 (source) into stable-security (Debian FTP Masters) (signed by: Markus Koschany)
[2022-10-29] Accepted batik 1.10-2+deb10u2 (source) into oldstable (Markus Koschany)
[2022-10-27] Accepted batik 1.16+dfsg-1 (source) into unstable (Pierre Gruet)
[2022-10-01] batik 1.15+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-09-25] Accepted batik 1.15+dfsg-1 (source) into unstable (Pierre Gruet)
[2022-07-24] batik 1.14-2 MIGRATED to testing (Debian testing watch)
[2022-07-18] Accepted batik 1.14-2 (source) into unstable (Pierre Gruet)
[2021-12-02] batik 1.14-1 MIGRATED to testing (Debian testing watch)
[2021-11-27] Accepted batik 1.14-1 (source) into unstable (tony mancill)
[2020-09-28] batik 1.12-4 MIGRATED to testing (Debian testing watch)
[2020-09-23] Accepted batik 1.12-4 (source) into unstable (Sudip Mukherjee)
[2020-09-11] batik 1.12-3 MIGRATED to testing (Debian testing watch)
[2020-09-05] Accepted batik 1.12-3 (source) into unstable (Sudip Mukherjee)
[2020-09-04] Accepted batik 1.12-2 (source) into unstable (Sudip Mukherjee)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.19-2
4 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing