CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

• Apache Batik

  APP
  Apache
  1.0 – 1.10 (excl.)

• Canonical Ubuntu

  OS
  Canonical
  14.04

• Debian

  OS
  Debian
  7.08.09.0

• Oracle Business Intelligence

  APP
  Oracle
  11.1.1.7.011.1.1.9.012.2.1.3.012.2.1.4.0

• Oracle Communications Diameter Signaling Router

  APP
  Oracle
  < 8.3

• Oracle Communications Metasolv Solution

  APP
  Oracle
  6.3.0

• Oracle Communications Webrtc Session Controller

  APP
  Oracle
  < 7.2

• Oracle Data Integrator

  APP
  Oracle
  12.2.1.3.0

• Oracle Enterprise Repository

  APP
  Oracle
  11.1.1.7.012.1.3.0.0

• Oracle Financial Services Analytical Applications Infrastructure

  APP
  Oracle
  7.3.3.0.0 – 7.3.3.0.28.0.0.0.0 – 8.0.7.1.0

• Oracle Fusion Middleware Mapviewer

  APP
  Oracle
  12.2.1.212.2.1.3

• Oracle Instantis Enterprisetrack

  APP
  Oracle
  17.117.217.3

• Oracle Insurance Calculation Engine

  APP
  Oracle
  10.1.110.2.1

• Oracle Insurance Policy Administration J2ee

  APP
  Oracle
  10.010.2

• Oracle Jd Edwards Enterpriseone Tools

  APP
  Oracle
  9.2

• Oracle Retail Back Office

  APP
  Oracle
  13.313.41414.1

• Oracle Retail Central Office

  APP
  Oracle
  14.1

• Oracle Retail Integration Bus

  APP
  Oracle
  17.0

• Oracle Retail Order Broker

  APP
  Oracle
  15.016.05.15.2

• Oracle Retail Point Of Service

  APP
  Oracle
  13.414.014.1

• Oracle Retail Returns Management

  APP
  Oracle
  14.1