description: In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
problem types: Information Disclosure
affected:
{
vendor: Apache Software Foundation
product: Apache Batik
versions:
version: 1.0 - 1.9.1, status: affected
}