Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-681

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Xalan-J	>= Xalan-J, <= 2.7.2

References

http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/04/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/07/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue Tracking, Mailing List, Vendor Advisory
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue Tracking, Mailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
https://www.debian.org/security/2022/dsa-5188Third Party Advisory
https://www.debian.org/security/2022/dsa-5192Third Party Advisory
https://www.debian.org/security/2022/dsa-5256Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/04/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/11/07/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue Tracking, Mailing List, Vendor Advisory
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue Tracking, Mailing List, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
https://www.debian.org/security/2022/dsa-5188Third Party Advisory
https://www.debian.org/security/2022/dsa-5192Third Party Advisory
https://www.debian.org/security/2022/dsa-5256Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Jul 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

CVE-2022-34169