CVE-2022-34169

原作者: [db:作者] 来自: [db:来源] 收藏邀请

Current Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

View Analysis Description

Severity

CVSS 3.x Severity and Metrics:

NIST: NVD

Base Score: 9.8 CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: NVD Analysts have published a CVSS score for this CVE based on publicly available information at the time of analysis. The CNA has not provided a score within the CVE List.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Hyperlink	Resource
http://www.openwall.com/lists/oss-security/2022/07/19/5	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/19/6	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/3	Mailing List Patch Third Party Advisory
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw	Issue Tracking Mailing List Vendor Advisory
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8	Issue Tracking Mailing List Vendor Advisory
https://www.debian.org/security/2022/dsa-5188	Third Party Advisory
https://www.debian.org/security/2022/dsa-5192	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-681	Incorrect Conversion between Numeric Types	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

7 change records found show changes

Initial Analysis 7/28/2022 10:26:58 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:a:apache:xalan-java::::::::* versions up to (including) 2.7.2
Added	CPE Configuration		Record truncated, showing 500 of 707 characters. View Entire Change Record OR cpe:2.3:a:oracle:graalvm:20.3.6::::enterprise:::* cpe:2.3:a:oracle:graalvm:21.3.2::::enterprise:::* cpe:2.3:a:oracle:graalvm:22.1.0::::enterprise:::* cpe:2.3:a:oracle:jdk:1.7.0:update343::::::* cpe:2.3:a:oracle:jdk:1.8.0:update333::::::* cpe:2.3:a:oracle:jdk:11.0.15.1::::::: cpe:2.3:a:oracle:jdk:17.0.3.1::::::: cpe:2.3:a:oracle:jdk:18.0.1.1::::::: cpe:2.3:a:oracle:jre:1.7.0:update343::::::
Added	CPE Configuration		OR cpe:2.3:o:debian:debian_linux:10.0::::::: cpe:2.3:o:debian:debian_linux:11.0:::::::
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-681
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2022/07/19/5 No Types Assigned	http://www.openwall.com/lists/oss-security/2022/07/19/5 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2022/07/19/6 No Types Assigned	http://www.openwall.com/lists/oss-security/2022/07/19/6 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2022/07/20/2 No Types Assigned	http://www.openwall.com/lists/oss-security/2022/07/20/2 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2022/07/20/3 No Types Assigned	http://www.openwall.com/lists/oss-security/2022/07/20/3 Mailing List, Patch, Third Party Advisory
Changed	Reference Type	https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw No Types Assigned	https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw Issue Tracking, Mailing List, Vendor Advisory
Changed	Reference Type	https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8 No Types Assigned	https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8 Issue Tracking, Mailing List, Vendor Advisory
Changed	Reference Type	https://www.debian.org/security/2022/dsa-5188 No Types Assigned	https://www.debian.org/security/2022/dsa-5188 Third Party Advisory
Changed	Reference Type	https://www.debian.org/security/2022/dsa-5192 No Types Assigned	https://www.debian.org/security/2022/dsa-5192 Third Party Advisory
Changed	Reference Type	https://www.oracle.com/security-alerts/cpujul2022.html No Types Assigned	https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory

鲜花

握手

雷人

路过

鸡蛋

该文章已有0人参与评论

请发表评论

全部评论

专题导读

More+

09-23 CVE-2020-36276

09-18 CVE-2022-36676

09-18 CVE-2022-36674

09-18 CVE-2022-36672

09-18 CVE-2022-36671

09-18 CVE-2022-36675

09-18 CVE-2022-36449

09-18 CVE-2022-36130

09-18 CVE-2022-37130

09-18 CVE-2022-37129

09-18 CVE-2022-37123

09-18 CVE-2022-36619

09-18 CVE-2022-37125

09-18 CVE-2022-36051

09-18 CVE-2022-36620

09-18 CVE-2022-36203

09-18 CVE-2022-36202

09-18 CVE-2022-36201

09-18 CVE-2022-2898

09-18 CVE-2022-2897

09-18 CVE-2022-2896

09-18 CVE-2022-2894

09-18 CVE-2022-2895

09-18 CVE-2022-2892

09-18 CVE-2022-36582

09-18 CVE-2022-36581

09-18 CVE-2022-36580

09-18 CVE-2022-36571

09-18 CVE-2022-36570

09-18 CVE-2022-36569

CVE-2022-34025发布时间：2022-07-29

CVE-2022-34024发布时间：2022-07-29

剪的笔顺,诠释剪的笔画,认识剪的部首

1 六六分期app的软件客服如何联系？(六六分期

六六分期app的软件客服如何联系？不知道吗？加qq群【895510560】即可！标题：六六分期

阅读：9819|2023-10-27

2 可心卡盟:win10系统火狐flash插件崩溃怎么

今天小编告诉大家如何处理win10系统火狐flash插件总是崩溃的问题，可能很多用户都不知

阅读：6716|2022-11-06

3 亲亲特价:怎么删除回收站图标

今天小编告诉大家如何对win10系统删除桌面回收站图标进行设置，可能很多用户都不知道

阅读：5624|2022-11-06

4 济南大学虚拟社区:鲁大师节能降温的具体办

今天小编告诉大家如何对win10系统电脑设置节能降温的设置方法，想必大家都遇到过需要

阅读：6120|2022-11-06

5 xlueops.exe:无线网络安装向导

我们在使用xp系统的过程中,经常需要对xp系统无线网络安装向导设置进行设置，可能很多

阅读：5972|2022-11-06

6 女斗合众国:win7系统cf与主机连接不稳定怎

今天小编告诉大家如何处理win7系统玩cf老是与主机连接不稳定的问题，可能很多用户都不

阅读：6341|2022-11-06

7 0xc000022-[cf烟雾头]cf怎么调烟雾头

电脑对日常生活的重要性小编就不多说了，可是一旦碰到win7系统设置cf烟雾头的问题，很

阅读：5918|2022-11-06

8 qizideyouhuo:应用程序无法正常启动0xc0000

我们在日常使用电脑的时候，有的小伙伴们可能在打开应用的时候会遇见提示应用程序无法

阅读：5394|2022-11-06

9 ipz-185:win7系统vcf文件怎么打开

今天小编告诉大家如何对win7系统打开vcf文件进行设置，可能很多用户都不知道怎么对win

阅读：5778|2022-11-06

10 傻哥蹦迪:win10系统s4怎么打开usb调试

今天小编告诉大家如何对win10系统s4开启USB调试模式进行设置，可能很多用户都不知道怎

阅读：5109|2022-11-06

客服电话

电子邮件

CVE-2022-34169

Current Description

Analysis Description

Severity

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

Initial Analysis 7/28/2022 10:26:58 AM

CVE Modified by Apache Software Foundation 7/27/2022 7:15:13 AM

CVE Modified by Apache Software Foundation 7/22/2022 11:15:08 PM

CVE Modified by Apache Software Foundation 7/21/2022 12:15:13 AM

CVE Modified by Apache Software Foundation 7/20/2022 8:15:09 AM

CVE Modified by Apache Software Foundation 7/19/2022 8:15:09 PM

CVE Modified by Apache Software Foundation 7/19/2022 5:15:15 PM

请发表评论

全部评论

上一篇：

下一篇：

CVE-2022-35357

bradtraversy/iweather: Ionic 3 mobile we

joaomh/curso-de-matlab

断牙刷新位置时间（断牙属性及刷新位置介绍

rugk/mastodon-simplified-federation: Sim

剪的笔顺,诠释剪的笔画,认识剪的部首

florent37/ViewAnimator: A fluent Android

florent37/Shrine-MaterialDesign2: implem

CVE-2020-36276

六六分期app的软件客服如何联系？(六六分期

doraiso/Mastodon

关于我们

产品与服务

解决方案

139-2527-9053