DSA-5256: -1 bcel -- security update

Published Oct 18, 2022

Updated

bcel - security update

Other sources

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. In Debian the vulnerable code is in the bcel source package.

Affected Software

2 affected components

debian/bcel

Event History

Oct 18, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-34169

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause the vulnerable Apache Xalan Java XSLT library to process a malicious XSLT stylesheet. The issue occurs in the internal XSLTC compiler while generating Java class files.

What is the potential impact if exploitation succeeds?

A malicious stylesheet can trigger integer truncation that corrupts generated Java class files. This may allow execution of arbitrary Java bytecode.

Which Debian package is identified as containing the vulnerable code?

In Debian, the vulnerable code is in the bcel source package.

DSA-5256: -1 bcel -- security update

Other sources

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which Debian package is identified as containing the vulnerable code?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which Debian package is identified as containing the vulnerable code?