CVE-2022-34169
CVE-2022-34169 · Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVSS 7.5 · High · EPSS 81.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache xalan-j
- Versions
- ≥ Xalan-J, ≤ 2.7.2: Affected (custom)
No fix published
bcel Debian:12
- Affected ranges
- ECOSYSTEM: < 6.5.0-2
Update to 6.5.0-2
bcel Debian:13
- Affected ranges
- ECOSYSTEM: < 6.5.0-2
Update to 6.5.0-2
bcel Debian:14
- Affected ranges
- ECOSYSTEM: < 6.5.0-2
Update to 6.5.0-2
openjdk-17 Debian:12
- Affected ranges
- ECOSYSTEM: < 17.0.4+8-1
Update to 17.0.4+8-1
libxalan2-java Ubuntu:14.04:LTS
- Versions
- 2.7.1-8
- 2.7.1-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-8 Ubuntu:Pro:16.04:LTS
- Versions
- 8u66-b01-5
- 8u72-b05-1ubuntu1
- 8u72-b05-5
- 8u72-b05-6
- 8u72-b15-1
- 8u72-b15-2ubuntu1
- 8u72-b15-2ubuntu3
- 8u72-b15-3ubuntu1
- 8u77-b03-1ubuntu2
- 8u77-b03-3ubuntu1
- 8u77-b03-3ubuntu2
- 8u77-b03-3ubuntu3
- 8u91-b14-0ubuntu4~16.04.1
- 8u91-b14-3ubuntu1~16.04.1
- 8u111-b14-2ubuntu0.16.04.2
- 8u121-b13-0ubuntu1.16.04.2
- 8u131-b11-0ubuntu1.16.04.2
- 8u131-b11-2ubuntu1.16.04.2
- 8u131-b11-2ubuntu1.16.04.3
- 8u151-b12-0ubuntu0.16.04.2
- 8u162-b12-0ubuntu0.16.04.2
- 8u171-b11-0ubuntu0.16.04.1
- 8u181-b13-0ubuntu0.16.04.1
- 8u181-b13-1ubuntu0.16.04.1
- 8u191-b12-0ubuntu0.16.04.1
- 8u191-b12-2ubuntu0.16.04.1
- 8u212-b03-0ubuntu1.16.04.1
- 8u222-b10-1ubuntu1~16.04.1
- 8u232-b09-0ubuntu1~16.04.1
- 8u242-b08-0ubuntu3~16.04
- 8u252-b09-1~16.04
- 8u265-b01-0ubuntu2~16.04
- 8u272-b10-0ubuntu1~16.04
- 8u275-b01-0ubuntu1~16.04
- 8u282-b08-0ubuntu1~16.04
- 8u292-b10-0ubuntu1~16.04.1
- 8u312-b07-0ubuntu1~16.04
- Affected ranges
- ECOSYSTEM: < 8u342-b07-0ubuntu1~16.04
Update to 8u342-b07-0ubuntu1~16.04
libxalan2-java Ubuntu:16.04:LTS
- Versions
- 2.7.1-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-9 Ubuntu:16.04:LTS
- Versions
- 9~b88-1
- 9~b101-2ubuntu2
- 9~b102-1
- 9~b113-0ubuntu1
- 9~b114-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-17 Ubuntu:18.04:LTS
- Versions
- 17+35-1~18.04
- 17.0.1+12-1~18.04
- 17.0.2+8-1~18.04
- 17.0.3+7-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: < 17.0.4+8-1~18.04
Update to 17.0.4+8-1~18.04
openjdk-8 Ubuntu:18.04:LTS
- Versions
- 8u144-b01-2
- 8u151-b12-1
- 8u162-b12-1
- 8u171-b11-0ubuntu0.18.04.1
- 8u181-b13-0ubuntu0.18.04.1
- 8u181-b13-1ubuntu0.18.04.1
- 8u191-b12-0ubuntu0.18.04.1
- 8u191-b12-2ubuntu0.18.04.1
- 8u212-b03-0ubuntu1.18.04.1
- 8u222-b10-1ubuntu1~18.04.1
- 8u232-b09-0ubuntu1~18.04.1
- 8u242-b08-0ubuntu3~18.04
- 8u252-b09-1~18.04
- 8u265-b01-0ubuntu2~18.04
- 8u272-b10-0ubuntu1~18.04
- 8u275-b01-0ubuntu1~18.04
- 8u282-b08-0ubuntu1~18.04
- 8u292-b10-0ubuntu1~18.04
- 8u312-b07-0ubuntu1~18.04
- Affected ranges
- ECOSYSTEM: < 8u342-b07-0ubuntu1~18.04
Update to 8u342-b07-0ubuntu1~18.04
openjdk-lts Ubuntu:18.04:LTS
- Versions
- 9.0.4+12-2ubuntu4
- 9.0.4+12-4ubuntu1
- 10~46-4ubuntu1
- 10~46-5ubuntu1
- 10.0.1+10-1ubuntu2
- 10.0.1+10-3ubuntu1
- 10.0.2+13-1ubuntu0.18.04.1
- 10.0.2+13-1ubuntu0.18.04.2
- 10.0.2+13-1ubuntu0.18.04.3
- 10.0.2+13-1ubuntu0.18.04.4
- 11.0.2+9-3ubuntu1~18.04.3
- 11.0.3+7-1ubuntu2~18.04.1
- 11.0.4+11-1ubuntu2~18.04.3
- 11.0.5+10-0ubuntu1.1~18.04
- 11.0.6+10-1ubuntu1~18.04.1
- 11.0.7+10-2ubuntu2~18.04
- 11.0.8+10-0ubuntu1~18.04.1
- 11.0.9+11-0ubuntu1~18.04.1
- 11.0.9.1+1-0ubuntu1~18.04
- 11.0.10+9-0ubuntu1~18.04
- 11.0.11+9-0ubuntu2~18.04
- 11.0.13+8-0ubuntu1~18.04
- 11.0.14+9-0ubuntu2~18.04
- 11.0.14.1+1-0ubuntu1~18.04
- 11.0.15+10-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: < 11.0.16+8-0ubuntu1~18.04
Update to 11.0.16+8-0ubuntu1~18.04
libxalan2-java Ubuntu:18.04:LTS
- Versions
- 2.7.1-9
- 2.7.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-17 Ubuntu:20.04:LTS
- Versions
- 17+35-1~20.04
- 17.0.1+12-1~20.04
- 17.0.2+8-1~20.04
- 17.0.3+7-0ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 17.0.4+8-1~20.04
Update to 17.0.4+8-1~20.04
openjdk-8 Ubuntu:20.04:LTS
- Versions
- 8u232-b09-0ubuntu1
- 8u232-b09-1
- 8u242-b04-1
- 8u242-b08-0ubuntu3
- 8u252-b07-1
- 8u252-b09-1ubuntu1
- 8u265-b01-0ubuntu2~20.04
- 8u272-b10-0ubuntu1~20.04
- 8u275-b01-0ubuntu1~20.04
- 8u282-b08-0ubuntu1~20.04
- 8u292-b10-0ubuntu1~20.04
- 8u312-b07-0ubuntu1~20.04
- Affected ranges
- ECOSYSTEM: < 8u342-b07-0ubuntu1~20.04
Update to 8u342-b07-0ubuntu1~20.04
openjdk-lts Ubuntu:20.04:LTS
- Versions
- 11.0.5+10-0ubuntu1
- 11.0.5+10-2ubuntu1
- 11.0.6+10-1ubuntu1
- 11.0.6+10-2ubuntu2
- 11.0.7+9-1ubuntu1
- 11.0.7+10-2ubuntu1
- 11.0.7+10-3ubuntu1
- 11.0.8+10-0ubuntu1~20.04
- 11.0.9+11-0ubuntu1~20.04
- 11.0.9.1+1-0ubuntu1~20.04
- 11.0.10+9-0ubuntu1~20.04
- 11.0.11+9-0ubuntu2~20.04
- 11.0.13+8-0ubuntu1~20.04
- 11.0.14+9-0ubuntu2~20.04
- 11.0.14.1+1-0ubuntu1~20.04
- 11.0.15+10-0ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 11.0.16+8-0ubuntu1~20.04
Update to 11.0.16+8-0ubuntu1~20.04
libxalan2-java Ubuntu:20.04:LTS
- Versions
- 2.7.2-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-13 Ubuntu:20.04:LTS
- Versions
- 13+33-1
- 13.0.1+9-2
- 13.0.2+8-1
- 13.0.2+8-2
- 13.0.3+3-1ubuntu2
- 13.0.4+8-1~20.04
- 13.0.7+5-0ubuntu1~20.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-16 Ubuntu:20.04:LTS
- Versions
- 16.0.1+9-1~20.04
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libxalan2-java Ubuntu:22.04:LTS
- Versions
- 2.7.2-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openjdk-17 Ubuntu:22.04:LTS
- Versions
- 17+35-1
- 17.0.1+12-1
- 17.0.2+8-1
- 17.0.3+7-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: < 17.0.4+8-1~22.04
Update to 17.0.4+8-1~22.04
openjdk-18 Ubuntu:22.04:LTS
- Versions
- 18~15ea-4
- 18~20ea-1
- 18~32ea-1
- 18~36ea-1
- Affected ranges
- ECOSYSTEM: < 18.0.2+9-2~22.04
Update to 18.0.2+9-2~22.04
openjdk-8 Ubuntu:22.04:LTS
- Versions
- 8u302-b08-0ubuntu2
- 8u312-b07-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 8u342-b07-0ubuntu1~22.04
Update to 8u342-b07-0ubuntu1~22.04
openjdk-lts Ubuntu:22.04:LTS
- Versions
- 11.0.12+7-0ubuntu3
- 11.0.13+8-0ubuntu1
- 11.0.14+9-0ubuntu2
- 11.0.14.1+1-0ubuntu1
- 11.0.15+10-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: < 11.0.16+8-0ubuntu1~22.04
Update to 11.0.16+8-0ubuntu1~22.04
Original sources
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- http://www.openwall.com/lists/oss-security/2022/07/19/5
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://www.openwall.com/lists/oss-security/2022/07/19/6
- http://www.openwall.com/lists/oss-security/2022/07/20/2
- http://www.openwall.com/lists/oss-security/2022/07/20/3
- https://www.debian.org/security/2022/dsa-5188
- https://www.debian.org/security/2022/dsa-5192
- https://security.netapp.com/advisory/ntap-20220729-0009/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
- http://www.openwall.com/lists/oss-security/2022/10/18/2
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
- https://www.debian.org/security/2022/dsa-5256
- http://www.openwall.com/lists/oss-security/2022/11/04/8
- http://www.openwall.com/lists/oss-security/2022/11/07/2
- https://security.gentoo.org/glsa/202401-25
- https://nvd.nist.gov/vuln/detail/CVE-2022-34169