VYPR
← All advisories
Critical severity9.8OSV Advisory· Published Apr 17, 2019· Updated Jun 17, 2026

CVE-2019-0228

CVE-2019-0228

Description

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.pdfbox:pdfboxMaven
>= 2.0.14, < 2.0.152.0.15

Affected products

34
  • Apache/JamesOSV3 versions
    2.0.14, cassandra_migration_v1_to_v2, james-project-3.0-beta5, …+ 2 more
    • (no CPE)range: 2.0.14, cassandra_migration_v1_to_v2, james-project-3.0-beta5, …
    • cpe:2.3:a:apache:james:3.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:james:3.4.0:*:*:*:*:*:*:*
  • Apache/Pdfbox
    cpe:2.3:a:apache:pdfbox:2.0.14:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Corporate Lending Process Management3 versions
    cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Credit Facilities Process Management3 versions
    cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Supply Chain Finance3 versions
    cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Trade Finance Process Management3 versions
    cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*
  • Oracle Corporation/Banking Virtual Account Management3 versions
    cpe:2.3:a:oracle:banking_virtual_account_management:14.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_virtual_account_management:14.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Messaging Server2 versions
    cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
    • cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Session Report Manager
    cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
    Range: >=8.0.0.0,<=8.2.4.0
  • Oracle Corporation/Hyperion Financial Reporting2 versions
    cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.6.0:*:*:*:*:*:*:*
  • Oracle Corporation/Peoplesoft Enterprise Peopletools2 versions
    cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
  • Oracle Corporation/Retail Xstore Point Of Service3 versions
    cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
  • Oracle Corporation/Webcenter Sites2 versions
    cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
  • Fedoraproject/Fedora2 versions
    cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.pdfbox/pdfbox
    Range: >= 2.0.14, < 2.0.15

Patches

Vulnerability mechanics

References

22

News mentions

0

No linked articles in our index yet.