CVE-2022-34169
high · 7.5The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
7.5
CVSS
81.0%
EPSS (exploit prob.)
100th
EPSS percentile
2022-07-19
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-681
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | xalan-java | <= 2.7.2 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| oracle | graalvm | 20.3.6 |
| oracle | graalvm | 21.3.2 |
| oracle | graalvm | 22.1.0 |
| oracle | jdk | 1.7.0 |
| oracle | jdk | 1.8.0 |
| oracle | jdk | 11.0.15.1 |
| oracle | jdk | 17.0.3.1 |
| oracle | jdk | 18.0.1.1 |
| oracle | jre | 1.7.0 |
| oracle | jre | 1.8.0 |
| oracle | jre | 11.0.15.1 |
| oracle | jre | 17.0.3.1 |
| oracle | jre | 18.0.1.1 |
| oracle | openjdk | >= 11, <= 11.0.15 |
| oracle | openjdk | >= 13, <= 13.0.11 |
| oracle | openjdk | >= 15, <= 15.0.7 |
| oracle | openjdk | >= 17, <= 17.0.3 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
| oracle | openjdk | 7 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
- http://www.openwall.com/lists/oss-security/2022/07/19/5
- http://www.openwall.com/lists/oss-security/2022/07/19/6
- http://www.openwall.com/lists/oss-security/2022/07/20/2
- http://www.openwall.com/lists/oss-security/2022/07/20/3
- http://www.openwall.com/lists/oss-security/2022/10/18/2
- http://www.openwall.com/lists/oss-security/2022/11/04/8
- http://www.openwall.com/lists/oss-security/2022/11/07/2
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20220729-0009/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5188
- https://www.debian.org/security/2022/dsa-5192
- https://www.debian.org/security/2022/dsa-5256
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-34169