An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2022-1977
Final
1.0
1.0
2022-09-30
Initial
2022-09-30
2022-09-30
openEuler SA Tool V1.0
2022-09-30
bcel security update
An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
The Byte Code Engineering Library (formerly known as JavaClass) is intended to give users a convenient possibility to analyze, create, and manipulate (binary) Java class files (those ending with .class).
Security Fix(es):
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.(CVE-2022-34169)
An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
bcel
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1977
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-34169
https://nvd.nist.gov/vuln/detail/CVE-2022-34169
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS
bcel-6.2-5.oe1.noarch.rpm
bcel-6.2-5.oe1.noarch.rpm
bcel-6.4.1-2.oe2203.noarch.rpm
bcel-6.2-5.oe1.src.rpm
bcel-6.2-5.oe1.src.rpm
bcel-6.4.1-2.oe2203.src.rpm
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
2022-09-30
CVE-2022-34169
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS
High
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
bcel security update
2022-09-30
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1977