NetSight
IP …
high7.5

CVE-2022-34169

Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets

Impact

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. A fix for this issue was published in September 2022 as part of an anticipated 2.7.3 release.

Affected packages

EcosystemPackageAffectedFixed in
mavenxalan:xalan< 2.7.32.7.3

Affected products

VendorProductAffected versions
ApacheXalan-Java
through 2.7.2
DebianDebian Linux
Versions 10.0, 11.0
OracleGraalvm
Versions 20.3.6, 21.3.2, 22.1.0
OracleJdk
Versions 1.7.0, 1.8.0, 11.0.15.1, 17.0.3.1, 18.0.1.1
OracleJre
Versions 1.7.0, 1.8.0, 11.0.15.1, 17.0.3.1, 18.0.1.1
OracleOpenjdk
from 11 through 11.0.15
from 13 through 13.0.11
from 15 through 15.0.7
from 17 through 17.0.3
Versions 7, 8
FedoraprojectFedora
Versions 35, 36
Netapp7-Mode Transition Tool
All versions
NetappActive Iq Unified Manager
All versions
NetappCloud Insights Acquisition Unit
All versions
NetappCloud Secure Agent
All versions
NetappHci Management Node
All versions

Weakness classification

CWE-681

References