[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DSA 5256-1] bcel security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5256-1                   security@debian.org
https://www.debian.org/security/                          Markus Koschany
October 18, 2022                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : bcel
CVE ID         : CVE-2022-34169
Debian Bug     : 1015860

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue
when processing malicious XSLT stylesheets. This can be used to corrupt Java
class files generated by the internal XSLTC compiler and execute arbitrary Java
bytecode. In Debian the vulnerable code is in the bcel source package.

For the stable distribution (bullseye), this problem has been fixed in
version 6.5.0-1+deb11u1.

We recommend that you upgrade your bcel packages.

For the detailed security status of bcel please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/bcel

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmNO6lRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeTIKg//T0o2OkmBcft4GuG7wPVTi1AgkDbxn+p541zijZ3w/ec6kBa/AznCaLpV
jv8Jf2ZSLeMqI+fXbcHkCF2P9P27Cj8mkheVa+OxxAiLnklG1nBaYnjsigYEkdYC
j4jt1hLpNX8Z1U8pxdbX7spmshWgZMBprRndKOMXD2xvbW7VvPz/oA47EcHsWmaB
xdepMt8aLsPyhvX3LrNTB5Fb9Dsx4EaRM20kVVzm+benT9U4CH9WsQNQotxeJ2LI
P7CNzkC6RXMG9mfXr2HyYhRD/Uid+bp+hJEzRkbpwwaqqvDXOOJEoNbzn3sNLRep
xnK/XnJ2K70iU3DWI6QBojoa2yb/7KmoicbUdScojTrpZClBvs35k+MtA/TCD6wE
A8anUiv2d4cnJ5lJdW7Wzuzzs7G4TF440p+NPY1AbCmQhhlLGJqU2ZrMl1qPfNfN
KL0KBgm3Dy/Pol1le0Lsu5LykXVBiMmpskot2IKJb27ZwdsoPwwAQMCpx0GODiva
WMfgqSBWvbci6PZc63CvNiE69dE9RxkHFtwycxoNewXdWmhFkX/iThacNEZadbI0
rwlamvBz4kGM+Q4YiUaXlH9o4yIgfiLg5cWlZrl5SWiqltIgnHMEbHDKip5IvQla
TtF6zKqFEvNZg3upRsdUfdtyxxEtNfSgXk+G40bi68QzX/F1x4Q=
=Xq3C
-----END PGP SIGNATURE-----


Reply to: