An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2022-1977 Final 1.0 1.0 2022-09-30 Initial 2022-09-30 2022-09-30 openEuler SA Tool V1.0 2022-09-30 bcel security update An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. The Byte Code Engineering Library (formerly known as JavaClass) is intended to give users a convenient possibility to analyze, create, and manipulate (binary) Java class files (those ending with .class). Security Fix(es): The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.(CVE-2022-34169) An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High bcel https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1977 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-34169 https://nvd.nist.gov/vuln/detail/CVE-2022-34169 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS bcel-6.2-5.oe1.noarch.rpm bcel-6.2-5.oe1.noarch.rpm bcel-6.4.1-2.oe2203.noarch.rpm bcel-6.2-5.oe1.src.rpm bcel-6.2-5.oe1.src.rpm bcel-6.4.1-2.oe2203.src.rpm The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan. 2022-09-30 CVE-2022-34169 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N bcel security update 2022-09-30 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1977