8.4 - Security fixes


Security fixes provided in 8.4.7

CVE Severity Description
CVE-2025-61385 High SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.
CVE-2025-48924 High Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(…) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.
CVE-2025-8869 Medium When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn’t implement PEP 706.
CVE-2022-45787 Medium Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions.
CVE-2023-4218 Medium In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks.

Security fixes provided in 8.4.4

Issue ID Found in Component
SQ34201 Imaging Core 8.4.3 DMT - SVN Extractor
SQ34304 Imaging Core 8.4.3 Consistency Checker
SQ34304 Imaging Core 8.4.3 Analysis Runner
SQ31101 Imaging Core 8.4.3 Consistency Checker
SQ31101 Imaging Core 8.4.3 Combined Importer
SQ31103 Imaging Core 8.4.3 Consistency Checker
SQ31103 Imaging Core 8.4.3 Tools Restore
SQ31103 Imaging Core 8.4.3 Analysis Runner
SQ31103 Imaging Core 8.4.3 CSSAdmin