~ / search / GHSA-9339-86wc-4qgf

GHSA-9339-86wc-4qgf

Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets

Source: GitHub Advisory Database (reviewed) High CVE-2022-34169

Packages

EcosystemPackageAffectedFixed in
Maven xalan:xalan < 2.7.3 2.7.3

Details

As written in the advisory (Markdown source, shown as plain text).

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. A fix for this issue was published in September 2022 as part of an anticipated 2.7.3 release.

References

External links from the advisory. They lead to third-party sites.