CVE-2022-34169

Published: Jul 19, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Affected (159)

Products: Apache: Xalan Java · Debian: Debian Linux · Oracle: Graalvm, Jdk, Jre, Openjdk · +3 more

Show all products

1 product

1 product

4 products

1 product

8 products

7 Mode Transition Tool

Active Iq Unified Manager

Cloud Insights Acquisition Unit

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xalan Java	Up to 2.7.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration C

13 vulnerable

Vulnerable Software	Affected Versions
Oracle Graalvm	Version 20.3.6
Oracle Graalvm	Version 21.3.2
Oracle Graalvm	Version 22.1.0
Oracle Jdk	Version 1.7.0 update343
Oracle Jdk	Version 1.8.0 update333
Oracle Jdk	Version 11.0.15.1
Oracle Jdk	Version 17.0.3.1
Oracle Jdk	Version 18.0.1.1
Oracle Jre	Version 1.7.0 update343
Oracle Jre	Version 1.8.0 update333
Oracle Jre	Version 11.0.15.1
Oracle Jre	Version 17.0.3.1
Oracle Jre	Version 18.0.1.1

Configuration D

124 vulnerable

Vulnerable Software	Affected Versions
Oracle Openjdk	From 11 to 11.0.15
Oracle Openjdk	From 13 to 13.0.11
Oracle Openjdk	From 15 to 15.0.7
Oracle Openjdk	From 17 to 17.0.3
Oracle Openjdk	Version 18
Oracle Openjdk	Version 7
Oracle Openjdk	Version 7 update101
Oracle Openjdk	Version 7 update10
Oracle Openjdk	Version 7 update111
Oracle Openjdk	Version 7 update11
Oracle Openjdk	Version 7 update121
Oracle Openjdk	Version 7 update131
Oracle Openjdk	Version 7 update13
Oracle Openjdk	Version 7 update141
Oracle Openjdk	Version 7 update151
Oracle Openjdk	Version 7 update15
Oracle Openjdk	Version 7 update161
Oracle Openjdk	Version 7 update171
Oracle Openjdk	Version 7 update17
Oracle Openjdk	Version 7 update181
Oracle Openjdk	Version 7 update191
Oracle Openjdk	Version 7 update1
Oracle Openjdk	Version 7 update201
Oracle Openjdk	Version 7 update211
Oracle Openjdk	Version 7 update21
Oracle Openjdk	Version 7 update221
Oracle Openjdk	Version 7 update231
Oracle Openjdk	Version 7 update241
Oracle Openjdk	Version 7 update251
Oracle Openjdk	Version 7 update25
Oracle Openjdk	Version 7 update261
Oracle Openjdk	Version 7 update271
Oracle Openjdk	Version 7 update281
Oracle Openjdk	Version 7 update291
Oracle Openjdk	Version 7 update2
Oracle Openjdk	Version 7 update301
Oracle Openjdk	Version 7 update311
Oracle Openjdk	Version 7 update321
Oracle Openjdk	Version 7 update3
Oracle Openjdk	Version 7 update40
Oracle Openjdk	Version 7 update45
Oracle Openjdk	Version 7 update4
Oracle Openjdk	Version 7 update51
Oracle Openjdk	Version 7 update55
Oracle Openjdk	Version 7 update5
Oracle Openjdk	Version 7 update60
Oracle Openjdk	Version 7 update65
Oracle Openjdk	Version 7 update67
Oracle Openjdk	Version 7 update6
Oracle Openjdk	Version 7 update72
Oracle Openjdk	Version 7 update76
Oracle Openjdk	Version 7 update7
Oracle Openjdk	Version 7 update80
Oracle Openjdk	Version 7 update85
Oracle Openjdk	Version 7 update91
Oracle Openjdk	Version 7 update95
Oracle Openjdk	Version 7 update97
Oracle Openjdk	Version 7 update99
Oracle Openjdk	Version 7 update9
Oracle Openjdk	Version 8
Oracle Openjdk	Version 8 milestone1
Oracle Openjdk	Version 8 milestone2
Oracle Openjdk	Version 8 milestone3
Oracle Openjdk	Version 8 milestone4
Oracle Openjdk	Version 8 milestone5
Oracle Openjdk	Version 8 milestone6
Oracle Openjdk	Version 8 milestone7
Oracle Openjdk	Version 8 milestone8
Oracle Openjdk	Version 8 milestone9
Oracle Openjdk	Version 8 update101
Oracle Openjdk	Version 8 update102
Oracle Openjdk	Version 8 update111
Oracle Openjdk	Version 8 update112
Oracle Openjdk	Version 8 update11
Oracle Openjdk	Version 8 update121
Oracle Openjdk	Version 8 update131
Oracle Openjdk	Version 8 update141
Oracle Openjdk	Version 8 update151
Oracle Openjdk	Version 8 update152
Oracle Openjdk	Version 8 update161
Oracle Openjdk	Version 8 update162
Oracle Openjdk	Version 8 update171
Oracle Openjdk	Version 8 update172
Oracle Openjdk	Version 8 update181
Oracle Openjdk	Version 8 update191
Oracle Openjdk	Version 8 update192
Oracle Openjdk	Version 8 update201
Oracle Openjdk	Version 8 update202
Oracle Openjdk	Version 8 update20
Oracle Openjdk	Version 8 update211
Oracle Openjdk	Version 8 update212
Oracle Openjdk	Version 8 update221
Oracle Openjdk	Version 8 update222
Oracle Openjdk	Version 8 update231
Oracle Openjdk	Version 8 update232
Oracle Openjdk	Version 8 update241
Oracle Openjdk	Version 8 update242
Oracle Openjdk	Version 8 update252
Oracle Openjdk	Version 8 update25
Oracle Openjdk	Version 8 update262
Oracle Openjdk	Version 8 update271
Oracle Openjdk	Version 8 update281
Oracle Openjdk	Version 8 update282
Oracle Openjdk	Version 8 update291
Oracle Openjdk	Version 8 update301
Oracle Openjdk	Version 8 update302
Oracle Openjdk	Version 8 update312
Oracle Openjdk	Version 8 update31
Oracle Openjdk	Version 8 update322
Oracle Openjdk	Version 8 update332
Oracle Openjdk	Version 8 update40
Oracle Openjdk	Version 8 update45
Oracle Openjdk	Version 8 update51
Oracle Openjdk	Version 8 update5
Oracle Openjdk	Version 8 update60
Oracle Openjdk	Version 8 update65
Oracle Openjdk	Version 8 update66
Oracle Openjdk	Version 8 update71
Oracle Openjdk	Version 8 update72
Oracle Openjdk	Version 8 update73
Oracle Openjdk	Version 8 update74
Oracle Openjdk	Version 8 update77
Oracle Openjdk	Version 8 update91
Oracle Openjdk	Version 8 update92

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration F

9 vulnerable

Vulnerable Software	Affected Versions
Netapp 7 Mode Transition Tool	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Insights Acquisition Unit	All versions
Netapp Cloud Secure Agent	All versions
Netapp Hci Compute Node	All versions
Netapp Hci Management Node	All versions
Netapp Oncommand Insight	All versions
Netapp Solidfire	All versions

Configuration G

8 vulnerable

Vulnerable Software	Affected Versions
Azul Zulu	Version 11.56
Azul Zulu	Version 13.48
Azul Zulu	Version 15.40
Azul Zulu	Version 17.34
Azul Zulu	Version 18.30
Azul Zulu	Version 6.47
Azul Zulu	Version 7.54
Azul Zulu	Version 8.62

Related CWEs

CWE-681

Incorrect Conversion between Numeric Types

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

References (48)

http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2022/07/19/5

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/07/19/6

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/07/20/2

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/07/20/3

Source: security@apache.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/10/18/2

Source: security@apache.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/11/04/8

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/11/07/2

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw

Source: security@apache.org

Issue TrackingMailing ListVendor Advisory

https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8

Source: security@apache.org

Issue TrackingMailing ListVendor Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/

Source: security@apache.org

https://security.gentoo.org/glsa/202401-25

Source: security@apache.org

https://security.netapp.com/advisory/ntap-20220729-0009/

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20240621-0006/

Source: security@apache.org

https://www.debian.org/security/2022/dsa-5188

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5192

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5256

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: security@apache.org

PatchThird Party Advisory

http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html