<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - itext 2.1.7 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13245#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - itext 2.1.7 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13245">bug 13245</a>
from <span class="vcard"><a class="email" href="mailto:y.tumanov@rosalinux.ru" title="Yury <y.tumanov@rosalinux.ru>"> <span class="fn">Yury</span></a>
</span></b>
<pre>
Этой уязвимости нет, но, т.к. абф лежал, она высветилась,
На абф исправлена
CVE-2017-9096
Desc: The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not
disable external entities, which might allow remote attackers to conduct XML
external entity (XXE) attacks via a crafted PDF.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9096">https://nvd.nist.gov/vuln/detail/CVE-2017-9096</a>
Severity: HIGH</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>