CVE-2022-34169

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html	Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2022/07/19/5	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/19/6	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/3	Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/18/2	Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/04/8	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/07/2	Mailing List Third Party Advisory
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw	Issue Tracking Mailing List Vendor Advisory
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8	Issue Tracking Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20220729-0009/	Third Party Advisory
https://www.debian.org/security/2022/dsa-5188	Third Party Advisory
https://www.debian.org/security/2022/dsa-5192	Third Party Advisory
https://www.debian.org/security/2022/dsa-5256	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:xalan-java:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:oracle:graalvm:20.3.6::::enterprise:::
	cpe:2.3:a:oracle:graalvm:21.3.2::::enterprise:::
	cpe:2.3:a:oracle:graalvm:22.1.0::::enterprise:::
	cpe:2.3:a:oracle:jdk:1.7.0:update343::::::
	cpe:2.3:a:oracle:jdk:1.8.0:update333::::::
	cpe:2.3:a:oracle:jdk:11.0.15.1:::::::*
	cpe:2.3:a:oracle:jdk:17.0.3.1:::::::*
	cpe:2.3:a:oracle:jdk:18.0.1.1:::::::*
	cpe:2.3:a:oracle:jre:1.7.0:update343::::::
	cpe:2.3:a:oracle:jre:1.8.0:update333::::::
	cpe:2.3:a:oracle:jre:11.0.15.1:::::::*
	cpe:2.3:a:oracle:jre:17.0.3.1:::::::*
	cpe:2.3:a:oracle:jre:18.0.1.1:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:oracle:openjdk::::::::
	cpe:2.3:a:oracle:openjdk::::::::
	cpe:2.3:a:oracle:openjdk::::::::
	cpe:2.3:a:oracle:openjdk::::::::
	cpe:2.3:a:oracle:openjdk:7:-::::::
	cpe:2.3:a:oracle:openjdk:7:update1::::::
	cpe:2.3:a:oracle:openjdk:7:update10::::::
	cpe:2.3:a:oracle:openjdk:7:update101::::::
	cpe:2.3:a:oracle:openjdk:7:update11::::::
	cpe:2.3:a:oracle:openjdk:7:update111::::::
	cpe:2.3:a:oracle:openjdk:7:update121::::::
	cpe:2.3:a:oracle:openjdk:7:update13::::::
	cpe:2.3:a:oracle:openjdk:7:update131::::::
	cpe:2.3:a:oracle:openjdk:7:update141::::::
	cpe:2.3:a:oracle:openjdk:7:update15::::::
	cpe:2.3:a:oracle:openjdk:7:update151::::::
	cpe:2.3:a:oracle:openjdk:7:update161::::::
	cpe:2.3:a:oracle:openjdk:7:update17::::::
	cpe:2.3:a:oracle:openjdk:7:update171::::::
	cpe:2.3:a:oracle:openjdk:7:update181::::::
	cpe:2.3:a:oracle:openjdk:7:update191::::::
	cpe:2.3:a:oracle:openjdk:7:update2::::::
	cpe:2.3:a:oracle:openjdk:7:update201::::::
	cpe:2.3:a:oracle:openjdk:7:update21::::::
	cpe:2.3:a:oracle:openjdk:7:update211::::::
	cpe:2.3:a:oracle:openjdk:7:update221::::::
	cpe:2.3:a:oracle:openjdk:7:update231::::::
	cpe:2.3:a:oracle:openjdk:7:update241::::::
	cpe:2.3:a:oracle:openjdk:7:update25::::::
	cpe:2.3:a:oracle:openjdk:7:update251::::::
	cpe:2.3:a:oracle:openjdk:7:update261::::::
	cpe:2.3:a:oracle:openjdk:7:update271::::::
	cpe:2.3:a:oracle:openjdk:7:update281::::::
	cpe:2.3:a:oracle:openjdk:7:update291::::::
	cpe:2.3:a:oracle:openjdk:7:update3::::::
	cpe:2.3:a:oracle:openjdk:7:update301::::::
	cpe:2.3:a:oracle:openjdk:7:update311::::::
	cpe:2.3:a:oracle:openjdk:7:update321::::::
	cpe:2.3:a:oracle:openjdk:7:update4::::::
	cpe:2.3:a:oracle:openjdk:7:update40::::::
	cpe:2.3:a:oracle:openjdk:7:update45::::::
	cpe:2.3:a:oracle:openjdk:7:update5::::::
	cpe:2.3:a:oracle:openjdk:7:update51::::::
	cpe:2.3:a:oracle:openjdk:7:update55::::::
	cpe:2.3:a:oracle:openjdk:7:update6::::::
	cpe:2.3:a:oracle:openjdk:7:update60::::::
	cpe:2.3:a:oracle:openjdk:7:update65::::::
	cpe:2.3:a:oracle:openjdk:7:update67::::::
	cpe:2.3:a:oracle:openjdk:7:update7::::::
	cpe:2.3:a:oracle:openjdk:7:update72::::::
	cpe:2.3:a:oracle:openjdk:7:update76::::::
	cpe:2.3:a:oracle:openjdk:7:update80::::::
	cpe:2.3:a:oracle:openjdk:7:update85::::::
	cpe:2.3:a:oracle:openjdk:7:update9::::::
	cpe:2.3:a:oracle:openjdk:7:update91::::::
	cpe:2.3:a:oracle:openjdk:7:update95::::::
	cpe:2.3:a:oracle:openjdk:7:update97::::::
	cpe:2.3:a:oracle:openjdk:7:update99::::::
	cpe:2.3:a:oracle:openjdk:8:-::::::
	cpe:2.3:a:oracle:openjdk:8:milestone1::::::
	cpe:2.3:a:oracle:openjdk:8:milestone2::::::
	cpe:2.3:a:oracle:openjdk:8:milestone3::::::
	cpe:2.3:a:oracle:openjdk:8:milestone4::::::
	cpe:2.3:a:oracle:openjdk:8:milestone5::::::
cpe:2.3:a:oracle:openjdk:8:milestone6::::::
cpe:2.3:a:oracle:openjdk:8:milestone7::::::
cpe:2.3:a:oracle:openjdk:8:milestone8::::::
cpe:2.3:a:oracle:openjdk:8:milestone9::::::
cpe:2.3:a:oracle:openjdk:8:update101::::::
cpe:2.3:a:oracle:openjdk:8:update102::::::
cpe:2.3:a:oracle:openjdk:8:update11::::::
cpe:2.3:a:oracle:openjdk:8:update111::::::
cpe:2.3:a:oracle:openjdk:8:update112::::::
cpe:2.3:a:oracle:openjdk:8:update121::::::
cpe:2.3:a:oracle:openjdk:8:update131::::::
cpe:2.3:a:oracle:openjdk:8:update141::::::
cpe:2.3:a:oracle:openjdk:8:update151::::::
cpe:2.3:a:oracle:openjdk:8:update152::::::
cpe:2.3:a:oracle:openjdk:8:update161::::::
cpe:2.3:a:oracle:openjdk:8:update162::::::
cpe:2.3:a:oracle:openjdk:8:update171::::::
cpe:2.3:a:oracle:openjdk:8:update172::::::
cpe:2.3:a:oracle:openjdk:8:update181::::::
cpe:2.3:a:oracle:openjdk:8:update191::::::
cpe:2.3:a:oracle:openjdk:8:update192::::::
cpe:2.3:a:oracle:openjdk:8:update20::::::
cpe:2.3:a:oracle:openjdk:8:update201::::::
cpe:2.3:a:oracle:openjdk:8:update202::::::
cpe:2.3:a:oracle:openjdk:8:update211::::::
cpe:2.3:a:oracle:openjdk:8:update212::::::
cpe:2.3:a:oracle:openjdk:8:update221::::::
cpe:2.3:a:oracle:openjdk:8:update222::::::
cpe:2.3:a:oracle:openjdk:8:update231::::::
cpe:2.3:a:oracle:openjdk:8:update232::::::
cpe:2.3:a:oracle:openjdk:8:update241::::::
cpe:2.3:a:oracle:openjdk:8:update242::::::
cpe:2.3:a:oracle:openjdk:8:update25::::::
cpe:2.3:a:oracle:openjdk:8:update252::::::
cpe:2.3:a:oracle:openjdk:8:update262::::::
cpe:2.3:a:oracle:openjdk:8:update271::::::
cpe:2.3:a:oracle:openjdk:8:update281::::::
cpe:2.3:a:oracle:openjdk:8:update282::::::
cpe:2.3:a:oracle:openjdk:8:update291::::::
cpe:2.3:a:oracle:openjdk:8:update301::::::
cpe:2.3:a:oracle:openjdk:8:update302::::::
cpe:2.3:a:oracle:openjdk:8:update31::::::
cpe:2.3:a:oracle:openjdk:8:update312::::::
cpe:2.3:a:oracle:openjdk:8:update322::::::
cpe:2.3:a:oracle:openjdk:8:update332::::::
cpe:2.3:a:oracle:openjdk:8:update40::::::
cpe:2.3:a:oracle:openjdk:8:update45::::::
cpe:2.3:a:oracle:openjdk:8:update5::::::
cpe:2.3:a:oracle:openjdk:8:update51::::::
cpe:2.3:a:oracle:openjdk:8:update60::::::
cpe:2.3:a:oracle:openjdk:8:update65::::::
cpe:2.3:a:oracle:openjdk:8:update66::::::
cpe:2.3:a:oracle:openjdk:8:update71::::::
cpe:2.3:a:oracle:openjdk:8:update72::::::
cpe:2.3:a:oracle:openjdk:8:update73::::::
cpe:2.3:a:oracle:openjdk:8:update74::::::
cpe:2.3:a:oracle:openjdk:8:update77::::::
cpe:2.3:a:oracle:openjdk:8:update91::::::
cpe:2.3:a:oracle:openjdk:8:update92::::::
cpe:2.3:a:oracle:openjdk:18:::::::*

Configuration 5 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:35:::::::*
	cpe:2.3:o:fedoraproject:fedora:36:::::::*

Configuration 6 (hide)

OR	cpe:2.3:a:netapp:7-mode_transition_tool:-:::::::*
	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
	cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:::::::*
	cpe:2.3:a:netapp:cloud_secure_agent:-:::::::*
	cpe:2.3:a:netapp:hci_management_node:-:::::::*
	cpe:2.3:a:netapp:oncommand_insight:-:::::::*
	cpe:2.3:a:netapp:solidfire:-:::::::*
	cpe:2.3:h:netapp:hci_compute_node:-:::::::*

Configuration 7 (hide)

OR	cpe:2.3:a:azul:zulu:6.47:::::::*
	cpe:2.3:a:azul:zulu:7.54:::::::*
	cpe:2.3:a:azul:zulu:8.62:::::::*
	cpe:2.3:a:azul:zulu:11.56:::::::*
	cpe:2.3:a:azul:zulu:13.48:::::::*
	cpe:2.3:a:azul:zulu:15.40:::::::*
	cpe:2.3:a:azul:zulu:17.34:::::::*
	cpe:2.3:a:azul:zulu:18.30:::::::*

History

17 Jan 2024, 15:15

Type	Values Removed	Values Added
References		() https://security.gentoo.org/glsa/202401-25 -

05 May 2023, 08:15

Type	Values Removed	Values Added
References	{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/', 'name': 'FEDORA-2022-19b6f21746', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/', 'name': 'FEDORA-2022-d26586b419', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/', 'name': 'FEDORA-2022-b76ab52e73', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/', 'name': 'FEDORA-2022-e573851f56', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/', 'name': 'FEDORA-2022-80afe2304a', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/', 'name': 'FEDORA-2022-ae563934f7', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}	(MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/ -
Summary	The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.	The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

27 Apr 2023, 17:36

Type	Values Removed	Values Added
CPE	cpe:2.3:a:azul:zulu:18.32:::::::* cpe:2.3:a:azul:zulu:8.64:::::::* cpe:2.3:a:azul:zulu:7.56:::::::* cpe:2.3:a:azul:zulu:13.50:::::::* cpe:2.3:a:azul:zulu:11.58:::::::* cpe:2.3:a:azul:zulu:17.35:::::::* cpe:2.3:a:azul:zulu:15.42:::::::* cpe:2.3:a:azul:zulu:11.57:::::::* cpe:2.3:a:azul:zulu:8.63:::::::* cpe:2.3:a:azul:zulu:6.49:::::::* cpe:2.3:a:azul:zulu:7.55:::::::* cpe:2.3:a:azul:zulu:13.49:::::::* cpe:2.3:a:azul:zulu:15.41:::::::* cpe:2.3:a:azul:zulu:17.36:::::::*	cpe:2.3:a:azul:zulu:11.56:::::::* cpe:2.3:a:azul:zulu:15.40:::::::* cpe:2.3:a:azul:zulu:17.34:::::::* cpe:2.3:a:azul:zulu:8.62:::::::* cpe:2.3:a:azul:zulu:18.30:::::::* cpe:2.3:a:azul:zulu:6.47:::::::* cpe:2.3:a:azul:zulu:13.48:::::::* cpe:2.3:a:azul:zulu:7.54:::::::*

29 Nov 2022, 02:07

Type	Values Removed	Values Added
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/11/07/2 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/11/07/2 - Mailing List, Third Party Advisory
References	~~(DEBIAN) https://www.debian.org/security/2022/dsa-5256 -~~	(DEBIAN) https://www.debian.org/security/2022/dsa-5256 - Third Party Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/10/18/2 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/10/18/2 - Mailing List, Patch, Third Party Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/11/04/8 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/11/04/8 - Mailing List, Third Party Advisory
References	~~(MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html -~~	(MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html - Mailing List, Third Party Advisory

07 Nov 2022, 22:15

Type	Values Removed	Values Added
References		(MLIST) http://www.openwall.com/lists/oss-security/2022/11/07/2 -

05 Nov 2022, 03:15

Type	Values Removed	Values Added
References		(MLIST) http://www.openwall.com/lists/oss-security/2022/11/04/8 -

19 Oct 2022, 08:15

Type	Values Removed	Values Added
References		(DEBIAN) https://www.debian.org/security/2022/dsa-5256 -

18 Oct 2022, 20:15

Type	Values Removed	Values Added
References		(MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html -

18 Oct 2022, 15:15

Type	Values Removed	Values Added
References		(MLIST) http://www.openwall.com/lists/oss-security/2022/10/18/2 -

30 Aug 2022, 15:03

Type	Values Removed	Values Added
CPE		cpe:2.3:o:fedoraproject:fedora:35:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : 7.5
References	~~(MISC) http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html -~~	(MISC) http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html - Third Party Advisory, VDB Entry
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/ - Mailing List, Third Party Advisory
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/ - Mailing List, Third Party Advisory
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/ - Mailing List, Third Party Advisory
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/ - Mailing List, Third Party Advisory
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/ - Mailing List, Third Party Advisory

26 Aug 2022, 16:15

Type	Values Removed	Values Added
References		(MISC) http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/ -

22 Aug 2022, 15:10

Type	Values Removed	Values Added
CPE		cpe:2.3:a:azul:zulu:15.42:::::::* cpe:2.3:a:azul:zulu:17.35:::::::* cpe:2.3:a:azul:zulu:7.55:::::::* cpe:2.3:a:azul:zulu:7.56:::::::* cpe:2.3:a:azul:zulu:11.58:::::::* cpe:2.3:a:azul:zulu:11.57:::::::* cpe:2.3:a:azul:zulu:13.50:::::::* cpe:2.3:a:azul:zulu:17.36:::::::* cpe:2.3:a:azul:zulu:8.63:::::::* cpe:2.3:a:azul:zulu:18.32:::::::* cpe:2.3:a:azul:zulu:13.49:::::::* cpe:2.3:a:azul:zulu:8.64:::::::* cpe:2.3:a:azul:zulu:6.49:::::::* cpe:2.3:a:azul:zulu:15.41:::::::*
First Time		Azul zulu Azul

08 Aug 2022, 15:09

Type	Values Removed	Values Added
First Time		Fedoraproject Fedoraproject fedora Netapp hci Management Node Netapp Netapp solidfire Netapp cloud Secure Agent Netapp oncommand Insight Oracle openjdk Netapp hci Compute Node Netapp active Iq Unified Manager Netapp cloud Insights Acquisition Unit Netapp 7-mode Transition Tool
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/ - Mailing List, Third Party Advisory
References	~~(CONFIRM) https://security.netapp.com/advisory/ntap-20220729-0009/ -~~	(CONFIRM) https://security.netapp.com/advisory/ntap-20220729-0009/ - Third Party Advisory
CPE		cpe:2.3:a:oracle:openjdk:8:update242:::::: cpe:2.3:a:oracle:openjdk:7:update211:::::: cpe:2.3:a:oracle:openjdk:::::::: cpe:2.3:a:oracle:openjdk:7:update17:::::: cpe:2.3:a:oracle:openjdk:8:update161:::::: cpe:2.3:a:oracle:openjdk:8:milestone2:::::: cpe:2.3:a:oracle:openjdk:7:update7:::::: cpe:2.3:a:oracle:openjdk:8:update51:::::: cpe:2.3:a:oracle:openjdk:7:update301:::::: cpe:2.3:a:oracle:openjdk:7:update141:::::: cpe:2.3:a:oracle:openjdk:7:update121:::::: cpe:2.3:a:oracle:openjdk:7:update25:::::: cpe:2.3:a:oracle:openjdk:7:update101:::::: cpe:2.3:a:oracle:openjdk:7:update85:::::: cpe:2.3:a:oracle:openjdk:7:update21:::::: cpe:2.3:a:oracle:openjdk:8:milestone4:::::: cpe:2.3:a:oracle:openjdk:8:update202:::::: cpe:2.3:a:oracle:openjdk:7:update191:::::: cpe:2.3:a:netapp:cloud_secure_agent:-:::::::* cpe:2.3:a:oracle:openjdk:7:update4:::::: cpe:2.3:a:oracle:openjdk:8:update60:::::: cpe:2.3:a:oracle:openjdk:8:update20:::::: cpe:2.3:a:oracle:openjdk:8:update191:::::: cpe:2.3:a:oracle:openjdk:8:update25:::::: cpe:2.3:a:oracle:openjdk:8:update5:::::: cpe:2.3:a:oracle:openjdk:7:update11:::::: cpe:2.3:a:oracle:openjdk:7:update40:::::: cpe:2.3:a:oracle:openjdk:8:update91:::::: cpe:2.3:a:oracle:openjdk:8:update112:::::: cpe:2.3:a:oracle:openjdk:7:update51:::::: cpe:2.3:a:oracle:openjdk:7:update201:::::: cpe:2.3:a:oracle:openjdk:18:::::::* cpe:2.3:a:oracle:openjdk:7:update45:::::: cpe:2.3:a:oracle:openjdk:8:update282:::::: cpe:2.3:a:oracle:openjdk:8:update111:::::: cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows:: cpe:2.3:a:oracle:openjdk:7:update221:::::: cpe:2.3:a:oracle:openjdk:8:update181:::::: cpe:2.3:a:oracle:openjdk:7:update171:::::: cpe:2.3:a:oracle:openjdk:7:update55:::::: cpe:2.3:a:oracle:openjdk:8:update291:::::: cpe:2.3:a:oracle:openjdk:8:update221:::::: cpe:2.3:a:oracle:openjdk:8:update162:::::: cpe:2.3:a:oracle:openjdk:8:milestone9:::::: cpe:2.3:a:oracle:openjdk:7:update80:::::: cpe:2.3:a:oracle:openjdk:8:update312:::::: cpe:2.3:a:oracle:openjdk:7:update251:::::: cpe:2.3:a:oracle:openjdk:7:update72:::::: cpe:2.3:a:oracle:openjdk:8:milestone6:::::: cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere:: cpe:2.3:a:oracle:openjdk:8:update92:::::: cpe:2.3:a:oracle:openjdk:7:update161:::::: cpe:2.3:a:oracle:openjdk:8:update11:::::: cpe:2.3:a:oracle:openjdk:7:update95:::::: cpe:2.3:a:oracle:openjdk:7:update131:::::: cpe:2.3:a:oracle:openjdk:8:-:::::: cpe:2.3:a:netapp:7-mode_transition_tool:-:::::::* cpe:2.3:a:oracle:openjdk:7:update65:::::: cpe:2.3:h:netapp:hci_compute_node:-:::::::* cpe:2.3:a:oracle:openjdk:7:update2:::::: cpe:2.3:a:oracle:openjdk:7:update181:::::: cpe:2.3:a:oracle:openjdk:7:update99:::::: cpe:2.3:a:oracle:openjdk:8:update74:::::: cpe:2.3:a:oracle:openjdk:7:update91:::::: cpe:2.3:a:oracle:openjdk:8:update301:::::: cpe:2.3:a:oracle:openjdk:8:update102:::::: cpe:2.3:a:oracle:openjdk:8:update66:::::: cpe:2.3:o:fedoraproject:fedora:36:::::::* cpe:2.3:a:netapp:hci_management_node:-:::::::* cpe:2.3:a:oracle:openjdk:8:update101:::::: cpe:2.3:a:oracle:openjdk:7:update5:::::: cpe:2.3:a:oracle:openjdk:8:update131:::::: cpe:2.3:a:oracle:openjdk:8:update31:::::: cpe:2.3:a:oracle:openjdk:7:update6:::::: cpe:2.3:a:oracle:openjdk:8:update77:::::: cpe:2.3:a:netapp:solidfire:-:::::::* cpe:2.3:a:oracle:openjdk:8:update40:::::: cpe:2.3:a:oracle:openjdk:8:update73:::::: cpe:2.3:a:oracle:openjdk:8:update171:::::: cpe:2.3:a:oracle:openjdk:8:update152:::::: cpe:2.3:a:oracle:openjdk:8:milestone1:::::: cpe:2.3:a:oracle:openjdk:7:update76:::::: cpe:2.3:a:oracle:openjdk:8:update232:::::: cpe:2.3:a:oracle:openjdk:7:update291:::::: cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:::::::* cpe:2.3:a:oracle:openjdk:7:update10:::::: cpe:2.3:a:oracle:openjdk:7:update111:::::: cpe:2.3:a:oracle:openjdk:8:update212:::::: cpe:2.3:a:oracle:openjdk:7:update281:::::: cpe:2.3:a:oracle:openjdk:8:milestone8:::::: cpe:2.3:a:oracle:openjdk:7:update97:::::: cpe:2.3:a:oracle:openjdk:8:update71:::::: cpe:2.3:a:oracle:openjdk:7:update231:::::: cpe:2.3:a:oracle:openjdk:8:update121:::::: cpe:2.3:a:oracle:openjdk:7:update1:::::: cpe:2.3:a:oracle:openjdk:7:update241:::::: cpe:2.3:a:oracle:openjdk:8:update141:::::: cpe:2.3:a:oracle:openjdk:7:update67:::::: cpe:2.3:a:oracle:openjdk:7:update321:::::: cpe:2.3:a:oracle:openjdk:8:milestone7:::::: cpe:2.3:a:netapp:oncommand_insight:-:::::::* cpe:2.3:a:oracle:openjdk:8:update211:::::: cpe:2.3:a:oracle:openjdk:7:update261:::::: cpe:2.3:a:oracle:openjdk:8:update302:::::: cpe:2.3:a:oracle:openjdk:8:milestone5:::::: cpe:2.3:a:oracle:openjdk:7:update13:::::: cpe:2.3:a:oracle:openjdk:8:update172:::::: cpe:2.3:a:oracle:openjdk:8:update262:::::: cpe:2.3:a:oracle:openjdk:8:update281:::::: cpe:2.3:a:oracle:openjdk:8:update72:::::: cpe:2.3:a:oracle:openjdk:7:update271:::::: cpe:2.3:a:oracle:openjdk:7:update311:::::: cpe:2.3:a:oracle:openjdk:7:update60:::::: cpe:2.3:a:oracle:openjdk:7:update15:::::: cpe:2.3:a:oracle:openjdk:7:update151:::::: cpe:2.3:a:oracle:openjdk:8:update231:::::: cpe:2.3:a:oracle:openjdk:8:milestone3:::::: cpe:2.3:a:oracle:openjdk:8:update252:::::: cpe:2.3:a:oracle:openjdk:8:update332:::::: cpe:2.3:a:oracle:openjdk:8:update241:::::: cpe:2.3:a:oracle:openjdk:8:update222:::::: cpe:2.3:a:oracle:openjdk:7:update3:::::: cpe:2.3:a:oracle:openjdk:8:update151:::::: cpe:2.3:a:oracle:openjdk:8:update322:::::: cpe:2.3:a:oracle:openjdk:8:update201:::::: cpe:2.3:a:oracle:openjdk:8:update65:::::: cpe:2.3:a:oracle:openjdk:8:update192:::::: cpe:2.3:a:oracle:openjdk:7:-:::::: cpe:2.3:a:oracle:openjdk:7:update9:::::: cpe:2.3:a:oracle:openjdk:8:update271:::::: cpe:2.3:a:oracle:openjdk:8:update45::::::

03 Aug 2022, 03:15

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/ -

29 Jul 2022, 20:15

Type	Values Removed	Values Added
References		(CONFIRM) https://security.netapp.com/advisory/ntap-20220729-0009/ -

28 Jul 2022, 14:26

Type	Values Removed	Values Added
References	~~(MISC) https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8 -~~	(MISC) https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8 - Issue Tracking, Mailing List, Vendor Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/07/20/3 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/07/20/3 - Mailing List, Patch, Third Party Advisory
References	~~(MISC) https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw -~~	(MISC) https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw - Issue Tracking, Mailing List, Vendor Advisory
References	~~(DEBIAN) https://www.debian.org/security/2022/dsa-5188 -~~	(DEBIAN) https://www.debian.org/security/2022/dsa-5188 - Third Party Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/07/19/6 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/07/19/6 - Mailing List, Third Party Advisory
References	~~(DEBIAN) https://www.debian.org/security/2022/dsa-5192 -~~	(DEBIAN) https://www.debian.org/security/2022/dsa-5192 - Third Party Advisory
References	~~(MISC) https://www.oracle.com/security-alerts/cpujul2022.html -~~	(MISC) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/07/19/5 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/07/19/5 - Mailing List, Third Party Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/07/20/2 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/07/20/2 - Mailing List, Third Party Advisory
CPE		cpe:2.3:a:oracle:graalvm:20.3.6::::enterprise::: cpe:2.3:a:oracle:jdk:17.0.3.1:::::::* cpe:2.3:a:oracle:graalvm:21.3.2::::enterprise::: cpe:2.3:o:debian:debian_linux:10.0:::::::* cpe:2.3:a:oracle:graalvm:22.1.0::::enterprise::: cpe:2.3:a:oracle:jre:11.0.15.1:::::::* cpe:2.3:a:apache:xalan-java:::::::: cpe:2.3:a:oracle:jre:1.8.0:update333:::::: cpe:2.3:a:oracle:jdk:1.8.0:update333:::::: cpe:2.3:a:oracle:jdk:18.0.1.1:::::::* cpe:2.3:a:oracle:jre:1.7.0:update343:::::: cpe:2.3:a:oracle:jdk:11.0.15.1:::::::* cpe:2.3:a:oracle:jre:18.0.1.1:::::::* cpe:2.3:a:oracle:jdk:1.7.0:update343:::::: cpe:2.3:a:oracle:jre:17.0.3.1:::::::* cpe:2.3:o:debian:debian_linux:11.0:::::::*
First Time		Oracle jre Oracle jdk Apache xalan-java Oracle graalvm Debian Debian debian Linux Apache Oracle
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CWE		CWE-681

27 Jul 2022, 11:15

Type	Values Removed	Values Added
References		(DEBIAN) https://www.debian.org/security/2022/dsa-5192 -

23 Jul 2022, 03:15

Type	Values Removed	Values Added
References		(DEBIAN) https://www.debian.org/security/2022/dsa-5188 -

21 Jul 2022, 04:15

Type	Values Removed	Values Added
References		(MISC) https://www.oracle.com/security-alerts/cpujul2022.html -

20 Jul 2022, 12:15

Type	Values Removed	Values Added
References		(MLIST) http://www.openwall.com/lists/oss-security/2022/07/20/2 - (MLIST) http://www.openwall.com/lists/oss-security/2022/07/20/3 -

20 Jul 2022, 00:15

Type	Values Removed	Values Added
References		(MLIST) http://www.openwall.com/lists/oss-security/2022/07/19/6 -

19 Jul 2022, 21:15

Type	Values Removed	Values Added
References		(MLIST) http://www.openwall.com/lists/oss-security/2022/07/19/5 -

19 Jul 2022, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-19 18:15

Updated : 2024-01-17 15:15

NVD link : CVE-2022-34169

Mitre link : CVE-2022-34169

CVE.ORG link : CVE-2022-34169

JSON object : View

Products Affected

netapp

7-mode_transition_tool
oncommand_insight
active_iq_unified_manager
hci_compute_node
hci_management_node
cloud_insights_acquisition_unit
solidfire
cloud_secure_agent

oracle

jre
graalvm
openjdk
jdk

azul

zulu

debian

debian_linux

fedoraproject

fedora

apache

xalan-java

CWE

CWE-681

Incorrect Conversion between Numeric Types

7.5 /10