CVE-2022-34169
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-34169
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-34169.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-34169
- Aliases
- Related
- Published
- 2022-07-19T18:15:11Z
- Modified
- 2024-09-03T08:23:22.274029Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
- References
-
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20220729-0009/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5188
- https://www.debian.org/security/2022/dsa-5192
- https://www.debian.org/security/2022/dsa-5256
- http://www.openwall.com/lists/oss-security/2022/07/19/5
- http://www.openwall.com/lists/oss-security/2022/07/19/6
- http://www.openwall.com/lists/oss-security/2022/07/20/2
- http://www.openwall.com/lists/oss-security/2022/07/20/3
- http://www.openwall.com/lists/oss-security/2022/10/18/2
- http://www.openwall.com/lists/oss-security/2022/11/04/8
- http://www.openwall.com/lists/oss-security/2022/11/07/2
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
Affected packages
Git / github.com/graalvm/graalvm-ce-builds
Affected ranges
- Type
- GIT
- Repo
- https://github.com/graalvm/graalvm-ce-builds
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affected
- Type
- GIT
- Repo
- https://github.com/openjdk/jdk
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affected
- Type
- GIT
- Repo
- https://github.com/openjdk/jdk15u
- Events
-
IntroducedLast affected
Affected versions
Other
jdk-15+36
jdk-15-ga
jdk7-b24
jdk7-b25
jdk7-b26
jdk7-b27
jdk7-b28
jdk7-b29
jdk7-b30
jdk7-b31
jdk7-b32
jdk7-b33
jdk7-b34
jdk7-b35
jdk7-b36
jdk7-b37
jdk7-b38
jdk7-b39
jdk7-b40
jdk7-b41
jdk7-b42
jdk7-b43
jdk7-b44
jdk7-b45
jdk-15.*
jdk-15.0.1+1
jdk-15.0.1+2
jdk-15.0.1+3
jdk-15.0.1+4
jdk-15.0.1+5
jdk-15.0.1+6
jdk-15.0.1+7
jdk-15.0.1+8
jdk-15.0.1+9
jdk-15.0.1-ga
jdk-15.0.2+0
jdk-15.0.2+1
jdk-15.0.2+2
jdk-15.0.2+3
jdk-15.0.2+4
jdk-15.0.2+5
jdk-15.0.2+6
jdk-15.0.2+7
jdk-15.0.2-ga
jdk-15.0.3+0
jdk-15.0.3+1
jdk-15.0.3+2
jdk-15.0.3+3
jdk-15.0.3-ga
jdk-15.0.4+0
jdk-15.0.4+1
jdk-15.0.4+2
jdk-15.0.4+3
jdk-15.0.4+4
jdk-15.0.4+5
jdk-15.0.4-ga
jdk-15.0.5+0
jdk-15.0.5+1
jdk-15.0.5+2
jdk-15.0.5+3
jdk-15.0.5-ga
jdk-15.0.6+0
jdk-15.0.6+1
jdk-15.0.6+2
jdk-15.0.6+3
jdk-15.0.6+4
jdk-15.0.6+5
jdk-15.0.6-ga
jdk-15.0.7+0
jdk-15.0.7+1
jdk-15.0.7+2
jdk-15.0.7+3
jdk-15.0.7+4
jdk-15.0.7-ga
vm-19.*
vm-19.3.0
vm-19.3.0.2
vm-19.3.1
vm-19.3.2
vm-19.3.2-pre
vm-19.3.3
vm-19.3.4
vm-19.3.5
vm-19.3.6
vm-20.*
vm-20.0.0
vm-20.0.1
vm-20.1.0
vm-20.2.0
vm-20.3.0
vm-20.3.1
vm-20.3.1.2
vm-20.3.2
vm-20.3.3
vm-20.3.4
vm-20.3.5
vm-20.3.6
vm-21.*
vm-21.0.0
vm-21.0.0.2
vm-21.1.0
vm-21.2.0
vm-21.3.0
vm-21.3.1
vm-22.*
vm-22.0.0.2
vm-ce-21.*
vm-ce-21.2.0