openSUSE-SU-2026:22109-1

openSUSE-SU-2026:22109-1 · Security update for bcel

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

This update for bcel fixes the following issues: - CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400). - CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399). Changes for bcel: - Update to version 6.13.0 * New Features + Add support for permitted subclasses + Add RecordComponentInfo.getAttribute(byte tag) + Add Const.MAJOR_27 + Add Const.MINOR_27 + Add and use ArrayType.isElementType(Type) + Add Const.MAJOR_28 + Add Const.MINOR_28 * Fixed Bugs + Fix constant pool module access test on Java 26 and above + Deprecate org.apache.bcel.classfile.Utility.Utility() + Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable) + Fix all Javadoc warnings and enforce checks by default + Escape constant pool names in generated HTML + Escape referenced names in BCELFactory Java output + Make wide flag thread-local in Utility.codeToString + Read multianewarray dimensions as unsigned byte + Site docs: clarify security model + Read ConstantDynamic indices as unsigned shorts + Validate index upper bound in CPInstruction, IINC and RET setIndex + Use correct attribute tag in NestHost and ModuleMainClass + Propagate runtime-visible flag when parsing parameter annotations + Use fixedLength for parsed LOOKUPSWITCH length + Fix ConstantPoolGen dedup key collisions for names with delimiters + Read unsigned bytecode operands in CodeHTML disassembler + Deep-copy bootstrap arguments array in BootstrapMethod.copy() + Use exclusive live-range end in LocalVariableTable .getLocalVariable + Build TABLESWITCH from sorted arrays in SWITCH + Use array element type not basic type for primitive array access + Set length in INVOKEDYNAMIC constructor + Reject CALOAD on non-char arrays in structural verification + Add negative verifier tests for remaining array load/store component type checks + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY + Match wide local variable instruction length to dumped bytes + Bound IINC increment to signed short + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8 + Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser + Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed + Opcodes tableswitch and lookupswitch add boundary checks + JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class + JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations + Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains + Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b + Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths + Disassembler and Class2HTML re-implement the unchecked switch-table allocation + ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle + Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies + Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114) + Silent u2/u1 count truncation across dump paths corrupts emitted bytecode + Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111) + Class2HTML builds output file paths from the unvalidated class name + ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field + PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence + Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate) + Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE + BCELifier interpolates attacker class/package names into generated Java source unescaped + Verifier pass 3a delayed checks are quadratic in attribute and code size + Verifier cache grows unboundedly with attacker-chosen class names + Static WIDE ThreadLocal survives exceptions, corrupting the next class's disassembly on the same thread + Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent non-canonical aliasing * Changes + Bump org.apache.commons:commons-parent from 95 to 104 + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20 + Bump commons-io:commons-io from 2.21.0 to 2.22.0 + Bump jna.version from 5.18.1 to 5.19.1 + [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0 - Changes of version 6.12.0 + Add Const.MAJOR_26 + Add Const.MINOR_26 + Fix infinite loop in example.TransitiveHull + Fix Apache RAT plugin console warnings + Fix malformed Javadoc comments + Make the build reproducible on the Azul JDK + Fix infinite loop in JavaClass.findField() on invalid input + Fix infinite loop in JavaClass.getAllInterfaces() on invalid input + Fix infinite loop in JavaClass.getSuperClasses() on invalid + Exception message in Args.requireU4() refers to the wrong data type + Exception message in Args.requireU2() refers to the wrong upper range value + Code.Code(int, int, DataInput, ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.Code(int, int, int, int, byte[], CodeException[], Attribute[], ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.setCode(byte[]) now throws a ClassFormatException if the code array is greater than the JVM specification allows + ClassDumper.dump() should not call the input stream it didn't open; fixes IOException when calling DumpClass.main (ClassDumper.java:351) + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses varagrs: ConstantPool(Constant...) + org.apache.bcel.classfile.Deprecated now requires its the attribute_length item be zero + org.apache.bcel.classfile.Synthetic now requires its the + The size of an Attribute unknown to the JVM specification is limited to 1 MB and is overridden with the system property BCEL.Attribute.Unknown.max_attribute_length + Bump org.apache.commons:commons-parent from 89 to 95 + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0 + Bump commons-io:commons-io from 2.20.0 to 2.21.0 + Bump commons-lang3 from 3.19.0 to 3.20.0 + [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0 - Changes of version 6.11.0 + Add Const.MAJOR_25 + Add Const.MINOR_25 + Add experimental CycloneDX VEX file + Refactor to use new Maven POM variable ecj.version + Replace internal use of Locale.ENGLISH with Locale.ROOT + BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz distribution file + BCEL-376: ClassPath.close() throws UnsupportedOperationException when created with system-classpath + ClassPath.getResources(String) can use an ArrayList instead of a Vector + Fix SpotBugs [ERROR] Medium: Operation on the "created" shared variable in "ConstantUtf8" class is not atomic [org.apache .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the "considered" shared variable in "ConstantUtf8" class is not atomic [org .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134] + org.apache.bcel.util.ClassPath .addJdkModules(String, List<String>) now reads the system property "jdk.module.path" instead of "java.modules.path" + Fix ConstantPoolModuleAccessTest failures on Java 25 + 377: Fix testing on Java 24 and up + Bump org.apache.commons:com

Korrektur verfügbar

Veröffentlicht

2026-10-16T12:21:25Z

Aktualisiert

2026-10-19T17:23:15.937624643Z

Technologie-Stack: system

Prüfen Sie Ihren Server →