CVE search · CVE-2022-34169
CVE-2022-34169
high 7.5
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Details
- Status
- Modified
- Published
- Last changed
- Source
- security@apache.org
- Weakness
- CWE-681
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
nvd@nist.govPrimary |
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- apache · xalan-java
- debian · debian_linux
- oracle · graalvm
- oracle · jdk
- oracle · jre
- oracle · openjdk
- fedoraproject · fedora
- netapp · 7-mode_transition_tool
- netapp · active_iq_unified_manager
- netapp · cloud_insights_acquisition_unit
- netapp · cloud_secure_agent
- netapp · hci_management_node
- netapp · oncommand_insight
- netapp · solidfire
- netapp · hci_compute_node
- azul · zulu
References
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/04/8Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/07/2Mailing ListThird Party Advisory
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue TrackingMailing ListVendor Advisory
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue TrackingMailing ListVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5188Third Party Advisory
- https://www.debian.org/security/2022/dsa-5192Third Party Advisory
- https://www.debian.org/security/2022/dsa-5256Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/04/8Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/07/2Mailing ListThird Party Advisory
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue TrackingMailing ListVendor Advisory
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue TrackingMailing ListVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5188Third Party Advisory
- https://www.debian.org/security/2022/dsa-5192Third Party Advisory
- https://www.debian.org/security/2022/dsa-5256Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory