7.5
High
CVE-2022-34169 The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT…
Description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Xalan-J 2.7 | earliest → 2.7.2 | No fix stated |
References
- lists.apache.org lists.apache.org
- lists.apache.org lists.apache.org
- [oss-security] 20220719 CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets www.openwall.com
- www.oracle.com www.oracle.com
- [oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets www.openwall.com
- [oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets www.openwall.com
- [oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets www.openwall.com
- DSA-5188 www.debian.org
- DSA-5192 www.debian.org
- security.netapp.com security.netapp.com
- FEDORA-2022-19b6f21746 lists.fedoraproject.org
- FEDORA-2022-ae563934f7 lists.fedoraproject.org
- FEDORA-2022-e573851f56 lists.fedoraproject.org
- FEDORA-2022-d26586b419 lists.fedoraproject.org
- FEDORA-2022-80afe2304a lists.fedoraproject.org
- FEDORA-2022-b76ab52e73 lists.fedoraproject.org
- packetstormsecurity.com packetstormsecurity.com
- [oss-security] 20221017 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets www.openwall.com
- [debian-lts-announce] 20221018 [SECURITY] [DLA 3155-1] bcel security update lists.debian.org
- DSA-5256 www.debian.org
- [oss-security] 20221104 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing www.openwall.com
- [oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing www.openwall.com
- security.gentoo.org security.gentoo.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified