Vulnerability Database
289,599
Total vulnerabilities in the database
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
| Software | From | Fixed in |
|---|---|---|
| apache / xalan-java | - | 2.7.2.x |
| debian / debian_linux | 10.0 | 10.0.x |
| debian / debian_linux | 11.0 | 11.0.x |
| oracle / jre | 17.0.3.1 | 17.0.3.1.x |
| oracle / jre | 18.0.1.1 | 18.0.1.1.x |
| oracle / jre | 11.0.15.1 | 11.0.15.1.x |
| oracle / jre | 1.8.0-update333 | 1.8.0-update333.x |
| oracle / jre | 1.7.0-update343 | 1.7.0-update343.x |
| oracle / jdk | 17.0.3.1 | 17.0.3.1.x |
| oracle / jdk | 18.0.1.1 | 18.0.1.1.x |
| oracle / jdk | 11.0.15.1 | 11.0.15.1.x |
| oracle / jdk | 1.8.0-update333 | 1.8.0-update333.x |
| oracle / jdk | 1.7.0-update343 | 1.7.0-update343.x |
| oracle / graalvm | 20.3.6 | 20.3.6.x |
| oracle / graalvm | 21.3.2 | 21.3.2.x |
| oracle / graalvm | 22.1.0 | 22.1.0.x |
| oracle / openjdk | 8 | 8.x |
| oracle / openjdk | 8-update102 | 8-update102.x |
| oracle / openjdk | 8-update112 | 8-update112.x |
| oracle / openjdk | 8-update152 | 8-update152.x |
| oracle / openjdk | 8-update162 | 8-update162.x |
| oracle / openjdk | 8-update172 | 8-update172.x |
| oracle / openjdk | 8-update192 | 8-update192.x |
| oracle / openjdk | 8-update20 | 8-update20.x |
| oracle / openjdk | 8-update202 | 8-update202.x |
| oracle / openjdk | 8-update212 | 8-update212.x |
| oracle / openjdk | 8-update222 | 8-update222.x |
| oracle / openjdk | 8-update232 | 8-update232.x |
| oracle / openjdk | 8-update40 | 8-update40.x |
| oracle / openjdk | 8-update60 | 8-update60.x |
| oracle / openjdk | 8-update66 | 8-update66.x |
| oracle / openjdk | 8-update72 | 8-update72.x |
| oracle / openjdk | 8-update92 | 8-update92.x |
| oracle / openjdk | 7-update241 | 7-update241.x |
| oracle / openjdk | 7-update80 | 7-update80.x |
| oracle / openjdk | 7-update85 | 7-update85.x |
| oracle / openjdk | 7 | 7.x |
| oracle / openjdk | 8-update241 | 8-update241.x |
| oracle / openjdk | 8-update65 | 8-update65.x |
| oracle / openjdk | 8-update71 | 8-update71.x |
| oracle / openjdk | 8-update73 | 8-update73.x |
| oracle / openjdk | 8-update74 | 8-update74.x |
| oracle / openjdk | 8-update77 | 8-update77.x |
| oracle / openjdk | 8-update91 | 8-update91.x |
| oracle / openjdk | 8-update101 | 8-update101.x |
| oracle / openjdk | 8-update111 | 8-update111.x |
| oracle / openjdk | 8-update121 | 8-update121.x |
| oracle / openjdk | 8-update131 | 8-update131.x |
| oracle / openjdk | 8-update141 | 8-update141.x |
| oracle / openjdk | 8-update151 | 8-update151.x |
| oracle / openjdk | 8-update161 | 8-update161.x |
| oracle / openjdk | 8-update171 | 8-update171.x |
| oracle / openjdk | 8-update181 | 8-update181.x |
| oracle / openjdk | 8-update191 | 8-update191.x |
| oracle / openjdk | 8-update201 | 8-update201.x |
| oracle / openjdk | 8-update211 | 8-update211.x |
| oracle / openjdk | 8-update45 | 8-update45.x |
| oracle / openjdk | 8-update51 | 8-update51.x |
| oracle / openjdk | 8-update25 | 8-update25.x |
| oracle / openjdk | 8-update31 | 8-update31.x |
| oracle / openjdk | 8-update5 | 8-update5.x |
| oracle / openjdk | 8-update11 | 8-update11.x |
| oracle / openjdk | 8-update221 | 8-update221.x |
| oracle / openjdk | 8-update231 | 8-update231.x |
| oracle / openjdk | 7-update251 | 7-update251.x |
| oracle / openjdk | 7-update231 | 7-update231.x |
| oracle / openjdk | 7-update221 | 7-update221.x |
| oracle / openjdk | 7-update211 | 7-update211.x |
| oracle / openjdk | 7-update201 | 7-update201.x |
| oracle / openjdk | 7-update191 | 7-update191.x |
| oracle / openjdk | 7-update181 | 7-update181.x |
| oracle / openjdk | 7-update171 | 7-update171.x |
| oracle / openjdk | 7-update161 | 7-update161.x |
| oracle / openjdk | 7-update151 | 7-update151.x |
| oracle / openjdk | 7-update141 | 7-update141.x |
| oracle / openjdk | 7-update131 | 7-update131.x |
| oracle / openjdk | 7-update121 | 7-update121.x |
| oracle / openjdk | 7-update111 | 7-update111.x |
| oracle / openjdk | 7-update101 | 7-update101.x |
| oracle / openjdk | 7-update99 | 7-update99.x |
| oracle / openjdk | 7-update97 | 7-update97.x |
| oracle / openjdk | 7-update95 | 7-update95.x |
| oracle / openjdk | 7-update91 | 7-update91.x |
| oracle / openjdk | 7-update76 | 7-update76.x |
| oracle / openjdk | 7-update72 | 7-update72.x |
| oracle / openjdk | 7-update67 | 7-update67.x |
| oracle / openjdk | 7-update65 | 7-update65.x |
| oracle / openjdk | 7-update60 | 7-update60.x |
| oracle / openjdk | 7-update55 | 7-update55.x |
| oracle / openjdk | 7-update51 | 7-update51.x |
| oracle / openjdk | 7-update45 | 7-update45.x |
| oracle / openjdk | 7-update40 | 7-update40.x |
| oracle / openjdk | 7-update25 | 7-update25.x |
| oracle / openjdk | 7-update21 | 7-update21.x |
| oracle / openjdk | 7-update17 | 7-update17.x |
| oracle / openjdk | 7-update15 | 7-update15.x |
| oracle / openjdk | 7-update13 | 7-update13.x |
| oracle / openjdk | 7-update11 | 7-update11.x |
| oracle / openjdk | 7-update10 | 7-update10.x |
| oracle / openjdk | 7-update9 | 7-update9.x |
| oracle / openjdk | 7-update7 | 7-update7.x |
| oracle / openjdk | 7-update6 | 7-update6.x |
| oracle / openjdk | 7-update5 | 7-update5.x |
| oracle / openjdk | 7-update4 | 7-update4.x |
| oracle / openjdk | 7-update3 | 7-update3.x |
| oracle / openjdk | 7-update2 | 7-update2.x |
| oracle / openjdk | 7-update1 | 7-update1.x |
| oracle / openjdk | 8-update271 | 8-update271.x |
| oracle / openjdk | 8-update281 | 8-update281.x |
| oracle / openjdk | 8-milestone1 | 8-milestone1.x |
| oracle / openjdk | 8-milestone2 | 8-milestone2.x |
| oracle / openjdk | 8-update282 | 8-update282.x |
| oracle / openjdk | 8-milestone3 | 8-milestone3.x |
| oracle / openjdk | 8-milestone4 | 8-milestone4.x |
| oracle / openjdk | 8-milestone5 | 8-milestone5.x |
| oracle / openjdk | 8-milestone6 | 8-milestone6.x |
| oracle / openjdk | 8-milestone7 | 8-milestone7.x |
| oracle / openjdk | 8-milestone8 | 8-milestone8.x |
| oracle / openjdk | 8-milestone9 | 8-milestone9.x |
| oracle / openjdk | 7-update271 | 7-update271.x |
| oracle / openjdk | 7-update281 | 7-update281.x |
| oracle / openjdk | 7-update291 | 7-update291.x |
| oracle / openjdk | 8-update242 | 8-update242.x |
| oracle / openjdk | 8-update252 | 8-update252.x |
| oracle / openjdk | 8-update262 | 8-update262.x |
| oracle / openjdk | 7-update261 | 7-update261.x |
| oracle / openjdk | 8-update291 | 8-update291.x |
| oracle / openjdk | 7-update301 | 7-update301.x |
| oracle / openjdk | 8-update301 | 8-update301.x |
| oracle / openjdk | 7-update311 | 7-update311.x |
| oracle / openjdk | 7-update321 | 7-update321.x |
| oracle / openjdk | 8-update312 | 8-update312.x |
| oracle / openjdk | 8-update302 | 8-update302.x |
| oracle / openjdk | 8-update322 | 8-update322.x |
| oracle / openjdk | 18 | 18.x |
| oracle / openjdk | 11 | 11.0.15.x |
| oracle / openjdk | 15 | 15.0.7.x |
| oracle / openjdk | 17 | 17.0.3.x |
| oracle / openjdk | 13 | 13.0.11.x |
| oracle / openjdk | 8-update332 | 8-update332.x |
| fedoraproject / fedora | 35 | 35.x |
| fedoraproject / fedora | 36 | 36.x |
xalan / xalan
|
- | 2.7.2.x |
| azul / zulu | 17.34 | 17.34.x |
| azul / zulu | 6.47 | 6.47.x |
| azul / zulu | 7.54 | 7.54.x |
| azul / zulu | 8.62 | 8.62.x |
| azul / zulu | 11.56 | 11.56.x |
| azul / zulu | 13.48 | 13.48.x |
| azul / zulu | 15.40 | 15.40.x |
| azul / zulu | 18.30 | 18.30.x |
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
- http://www.openwall.com/lists/oss-security/2022/07/19/5
- http://www.openwall.com/lists/oss-security/2022/07/19/6
- http://www.openwall.com/lists/oss-security/2022/07/20/2
- http://www.openwall.com/lists/oss-security/2022/07/20/3
- http://www.openwall.com/lists/oss-security/2022/10/18/2
- http://www.openwall.com/lists/oss-security/2022/11/04/8
- http://www.openwall.com/lists/oss-security/2022/11/07/2
- https://gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=2e60d0a9a5b822c4abf9051857973b1c6babfe81
- https://gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=ab57211e5d2e97cbed06786f919fa9b749c83573
- https://gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=da3e0d06b467247643ce04e88d3346739d119f21
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://lists.apache.org/thread/x3f7xv3p1g32qj2hlg8wd57pwcpld471
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20220729-0009/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5188
- https://www.debian.org/security/2022/dsa-5192
- https://www.debian.org/security/2022/dsa-5256
- https://www.oracle.com/security-alerts/cpujul2022.html