{ "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", "CVE_data_meta": { "ID": "CVE-2022-34169", "ASSIGNER": "security@apache.org", "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", "value": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "integer truncation" } ] } ] }, "affects": { "vendor": { "vendor_data": [ { "vendor_name": "Apache Software Foundation", "product": { "product_data": [ { "product_name": "Apache Xalan-J", "version": { "version_data": [ { "version_affected": "<=", "version_name": "Xalan-J", "version_value": "2.7.2" } ] } } ] } } ] } }, "references": { "reference_data": [ { "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8", "refsource": "MISC", "name": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8" }, { "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw", "refsource": "MISC", "name": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw" }, { "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/07/19/5" }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html", "refsource": "MISC", "name": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/07/19/6" }, { "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/07/20/2" }, { "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/07/20/3" }, { "url": "https://www.debian.org/security/2022/dsa-5188", "refsource": "MISC", "name": "https://www.debian.org/security/2022/dsa-5188" }, { "url": "https://www.debian.org/security/2022/dsa-5192", "refsource": "MISC", "name": "https://www.debian.org/security/2022/dsa-5192" }, { "url": "https://security.netapp.com/advisory/ntap-20220729-0009/", "refsource": "MISC", "name": "https://security.netapp.com/advisory/ntap-20220729-0009/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/", "refsource": "MISC", "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/", "refsource": "MISC", "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/", "refsource": "MISC", "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/", "refsource": "MISC", "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/", "refsource": "MISC", "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/", "refsource": "MISC", "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/" }, { "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html", "refsource": "MISC", "name": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html" }, { "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/10/18/2" }, { "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html", "refsource": "MISC", "name": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html" }, { "url": "https://www.debian.org/security/2022/dsa-5256", "refsource": "MISC", "name": "https://www.debian.org/security/2022/dsa-5256" }, { "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/11/04/8" }, { "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2", "refsource": "MISC", "name": "http://www.openwall.com/lists/oss-security/2022/11/07/2" }, { "url": "https://security.gentoo.org/glsa/202401-25", "refsource": "MISC", "name": "https://security.gentoo.org/glsa/202401-25" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006/", "refsource": "MISC", "name": "https://security.netapp.com/advisory/ntap-20240621-0006/" } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "source": { "discovery": "UNKNOWN" }, "credits": [ { "lang": "en", "value": "Reported by Felix Wilhelm, Google Project Zero" } ] }