Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Weaknesses 1

Affected Products 159

References 24

• packetstormsecurity.com http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
  Third Party AdvisoryVDB Entry
• openwall.com http://www.openwall.com/lists/oss-security/2022/07/19/5
  Mailing ListThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/07/19/6
  Mailing ListThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/07/20/2
  Mailing ListThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/07/20/3
  Mailing ListPatchThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/10/18/2
  Mailing ListPatchThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/11/04/8
  Mailing ListThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/11/07/2
  Mailing ListThird Party Advisory
• lists.apache.org https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
  Issue TrackingMailing ListVendor Advisory
• lists.apache.org https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
  Issue TrackingMailing ListVendor Advisory
• lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
  Mailing ListThird Party Advisory
• lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
• lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
• lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
• lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
• lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
• lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
• security.gentoo.org https://security.gentoo.org/glsa/202401-25
• security.netapp.com https://security.netapp.com/advisory/ntap-20220729-0009/
  Third Party Advisory
• security.netapp.com https://security.netapp.com/advisory/ntap-20240621-0006/
• debian.org https://www.debian.org/security/2022/dsa-5188
  Third Party Advisory
• debian.org https://www.debian.org/security/2022/dsa-5192
  Third Party Advisory
• debian.org https://www.debian.org/security/2022/dsa-5256
  Third Party Advisory
• oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
  PatchThird Party Advisory

Remediation

• openwall.com http://www.openwall.com/lists/oss-security/2022/07/20/3
  Mailing ListPatchThird Party Advisory
• openwall.com http://www.openwall.com/lists/oss-security/2022/10/18/2
  Mailing ListPatchThird Party Advisory
• oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
  PatchThird Party Advisory