7.5

CVE-2022-34169

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Xalan-java Version <= 2.7.2
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
Oracle ≫ Graalvm Version 20.3.6 SwEdition enterprise
Oracle ≫ Graalvm Version 21.3.2 SwEdition enterprise
Oracle ≫ Graalvm Version 22.1.0 SwEdition enterprise
Oracle ≫ Jdk Version 1.7.0 Update update343
Oracle ≫ Jdk Version 1.8.0 Update update333
Oracle ≫ Jdk Version 11.0.15.1
Oracle ≫ Jdk Version 17.0.3.1
Oracle ≫ Jdk Version 18.0.1.1
Oracle ≫ Jre Version 1.7.0 Update update343
Oracle ≫ Jre Version 1.8.0 Update update333
Oracle ≫ Jre Version 11.0.15.1
Oracle ≫ Jre Version 17.0.3.1
Oracle ≫ Jre Version 18.0.1.1
Oracle ≫ Openjdk Version >= 11 <= 11.0.15
Oracle ≫ Openjdk Version >= 13 <= 13.0.11
Oracle ≫ Openjdk Version >= 15 <= 15.0.7
Oracle ≫ Openjdk Version >= 17 <= 17.0.3
Oracle ≫ Openjdk Version 7 Update -
Oracle ≫ Openjdk Version 7 Update update1
Oracle ≫ Openjdk Version 7 Update update10
Oracle ≫ Openjdk Version 7 Update update101
Oracle ≫ Openjdk Version 7 Update update11
Oracle ≫ Openjdk Version 7 Update update111
Oracle ≫ Openjdk Version 7 Update update121
Oracle ≫ Openjdk Version 7 Update update13
Oracle ≫ Openjdk Version 7 Update update131
Oracle ≫ Openjdk Version 7 Update update141
Oracle ≫ Openjdk Version 7 Update update15
Oracle ≫ Openjdk Version 7 Update update151
Oracle ≫ Openjdk Version 7 Update update161
Oracle ≫ Openjdk Version 7 Update update17
Oracle ≫ Openjdk Version 7 Update update171
Oracle ≫ Openjdk Version 7 Update update181
Oracle ≫ Openjdk Version 7 Update update191
Oracle ≫ Openjdk Version 7 Update update2
Oracle ≫ Openjdk Version 7 Update update201
Oracle ≫ Openjdk Version 7 Update update21
Oracle ≫ Openjdk Version 7 Update update211
Oracle ≫ Openjdk Version 7 Update update221
Oracle ≫ Openjdk Version 7 Update update231
Oracle ≫ Openjdk Version 7 Update update241
Oracle ≫ Openjdk Version 7 Update update25
Oracle ≫ Openjdk Version 7 Update update251
Oracle ≫ Openjdk Version 7 Update update261
Oracle ≫ Openjdk Version 7 Update update271
Oracle ≫ Openjdk Version 7 Update update281
Oracle ≫ Openjdk Version 7 Update update291
Oracle ≫ Openjdk Version 7 Update update3
Oracle ≫ Openjdk Version 7 Update update301
Oracle ≫ Openjdk Version 7 Update update311
Oracle ≫ Openjdk Version 7 Update update321
Oracle ≫ Openjdk Version 7 Update update4
Oracle ≫ Openjdk Version 7 Update update40
Oracle ≫ Openjdk Version 7 Update update45
Oracle ≫ Openjdk Version 7 Update update5
Oracle ≫ Openjdk Version 7 Update update51
Oracle ≫ Openjdk Version 7 Update update55
Oracle ≫ Openjdk Version 7 Update update6
Oracle ≫ Openjdk Version 7 Update update60
Oracle ≫ Openjdk Version 7 Update update65
Oracle ≫ Openjdk Version 7 Update update67
Oracle ≫ Openjdk Version 7 Update update7
Oracle ≫ Openjdk Version 7 Update update72
Oracle ≫ Openjdk Version 7 Update update76
Oracle ≫ Openjdk Version 7 Update update80
Oracle ≫ Openjdk Version 7 Update update85
Oracle ≫ Openjdk Version 7 Update update9
Oracle ≫ Openjdk Version 7 Update update91
Oracle ≫ Openjdk Version 7 Update update95
Oracle ≫ Openjdk Version 7 Update update97
Oracle ≫ Openjdk Version 7 Update update99
Oracle ≫ Openjdk Version 8 Update -
Oracle ≫ Openjdk Version 8 Update milestone1
Oracle ≫ Openjdk Version 8 Update milestone2
Oracle ≫ Openjdk Version 8 Update milestone3
Oracle ≫ Openjdk Version 8 Update milestone4
Oracle ≫ Openjdk Version 8 Update milestone5
Oracle ≫ Openjdk Version 8 Update milestone6
Oracle ≫ Openjdk Version 8 Update milestone7
Oracle ≫ Openjdk Version 8 Update milestone8
Oracle ≫ Openjdk Version 8 Update milestone9
Oracle ≫ Openjdk Version 8 Update update101
Oracle ≫ Openjdk Version 8 Update update102
Oracle ≫ Openjdk Version 8 Update update11
Oracle ≫ Openjdk Version 8 Update update111
Oracle ≫ Openjdk Version 8 Update update112
Oracle ≫ Openjdk Version 8 Update update121
Oracle ≫ Openjdk Version 8 Update update131
Oracle ≫ Openjdk Version 8 Update update141
Oracle ≫ Openjdk Version 8 Update update151
Oracle ≫ Openjdk Version 8 Update update152
Oracle ≫ Openjdk Version 8 Update update161
Oracle ≫ Openjdk Version 8 Update update162
Oracle ≫ Openjdk Version 8 Update update171
Oracle ≫ Openjdk Version 8 Update update172
Oracle ≫ Openjdk Version 8 Update update181
Oracle ≫ Openjdk Version 8 Update update191
Oracle ≫ Openjdk Version 8 Update update192
Oracle ≫ Openjdk Version 8 Update update20
Oracle ≫ Openjdk Version 8 Update update201
Oracle ≫ Openjdk Version 8 Update update202
Oracle ≫ Openjdk Version 8 Update update211
Oracle ≫ Openjdk Version 8 Update update212
Oracle ≫ Openjdk Version 8 Update update221
Oracle ≫ Openjdk Version 8 Update update222
Oracle ≫ Openjdk Version 8 Update update231
Oracle ≫ Openjdk Version 8 Update update232
Oracle ≫ Openjdk Version 8 Update update241
Oracle ≫ Openjdk Version 8 Update update242
Oracle ≫ Openjdk Version 8 Update update25
Oracle ≫ Openjdk Version 8 Update update252
Oracle ≫ Openjdk Version 8 Update update262
Oracle ≫ Openjdk Version 8 Update update271
Oracle ≫ Openjdk Version 8 Update update281
Oracle ≫ Openjdk Version 8 Update update282
Oracle ≫ Openjdk Version 8 Update update291
Oracle ≫ Openjdk Version 8 Update update301
Oracle ≫ Openjdk Version 8 Update update302
Oracle ≫ Openjdk Version 8 Update update31
Oracle ≫ Openjdk Version 8 Update update312
Oracle ≫ Openjdk Version 8 Update update322
Oracle ≫ Openjdk Version 8 Update update332
Oracle ≫ Openjdk Version 8 Update update40
Oracle ≫ Openjdk Version 8 Update update45
Oracle ≫ Openjdk Version 8 Update update5
Oracle ≫ Openjdk Version 8 Update update51
Oracle ≫ Openjdk Version 8 Update update60
Oracle ≫ Openjdk Version 8 Update update65
Oracle ≫ Openjdk Version 8 Update update66
Oracle ≫ Openjdk Version 8 Update update71
Oracle ≫ Openjdk Version 8 Update update72
Oracle ≫ Openjdk Version 8 Update update73
Oracle ≫ Openjdk Version 8 Update update74
Oracle ≫ Openjdk Version 8 Update update77
Oracle ≫ Openjdk Version 8 Update update91
Oracle ≫ Openjdk Version 8 Update update92
Oracle ≫ Openjdk Version 18
Fedoraproject ≫ Fedora Version 35
Fedoraproject ≫ Fedora Version 36
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows
Netapp ≫ Cloud Secure Agent Version -
Netapp ≫ Hci Management Node Version -
Netapp ≫ Oncommand Insight Version -
Netapp ≫ Solidfire Version -
Netapp ≫ Hci Compute Node Version -
Azul ≫ Zulu Version 6.47
Azul ≫ Zulu Version 7.54
Azul ≫ Zulu Version 8.62
Azul ≫ Zulu Version 11.56
Azul ≫ Zulu Version 13.48
Azul ≫ Zulu Version 15.40
Azul ≫ Zulu Version 17.34
Azul ≫ Zulu Version 18.30
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 81.04% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-681 Incorrect Conversion between Numeric Types

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2022/07/19/5
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/19/6
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/20/2
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/20/3
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/18/2
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/11/04/8
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2022/11/07/2
Third Party Advisory
Mailing List
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
Vendor Advisory
Mailing List
Issue Tracking
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
Vendor Advisory
Mailing List
Issue Tracking
https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20220729-0009/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5188
Third Party Advisory
https://www.debian.org/security/2022/dsa-5192
Third Party Advisory
https://www.debian.org/security/2022/dsa-5256
Third Party Advisory