CVE-2022-34169

Katalog CVE

CVSS 7.5 · High EPSS 81,8%

Kerentanan Incorrect Conversion between Numeric Types pada apache xalan-java, debian linux +4 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Rincian

Terbit di NVD

19 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

81,8% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 158 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw issue tracking · mailing list · advisory vendor
• https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8 issue tracking · mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/07/20/3 mailing list · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/10/18/2 mailing list · patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html advisory pihak ketiga · vdb entry
• http://www.openwall.com/lists/oss-security/2022/07/19/5 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/07/19/6 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/07/20/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/11/04/8 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/11/07/2 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220729-0009/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5188 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5192 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5256 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCN...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLO...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZL...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3U...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPF...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQ...
• https://security.gentoo.org/glsa/202401-25
• https://security.netapp.com/advisory/ntap-20240621-0006/