1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 5256-1] bcel security update

    From Markus Koschany@21:1/5 to All on Tue Oct 18 20:30:01 2022
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5256-1 security@debian.org https://www.debian.org/security/ Markus Koschany October 18, 2022 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : bcel
    CVE ID : CVE-2022-34169
    Debian Bug : 1015860

    The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. In Debian the vulnerable code is in the bcel source package.

    For the stable distribution (bullseye), this problem has been fixed in
    version 6.5.0-1+deb11u1.

    We recommend that you upgrade your bcel packages.

    For the detailed security status of bcel please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/bcel

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmNO6lRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeTIKg//T0o2OkmBcft4GuG7wPVTi1AgkDbxn+p541zijZ3w/ec6kBa/AznCaLpV jv8Jf2ZSLeMqI+fXbcHkCF2P9P27Cj8mkheVa+OxxAiLnklG1nBaYnjsigYEkdYC j4jt1hLpNX8Z1U8pxdbX7spmshWgZMBprRndKOMXD2xvbW7VvPz/oA47EcHsWmaB xdepMt8aLsPyhvX3LrNTB5Fb9Dsx4EaRM20kVVzm+benT9U4CH9WsQNQotxeJ2LI P7CNzkC6RXMG9mfXr2HyYhRD/Uid+bp+hJEzRkbpwwaqqvDXOOJEoNbzn3sNLRep xnK/XnJ2K70iU3DWI6QBojoa2yb/7KmoicbUdScojTrpZClBvs35k+MtA/TCD6wE A8anUiv2d4cnJ5lJdW7Wzuzzs7G4TF440p+NPY1AbCmQhhlLGJqU2ZrMl1qPfNfN KL0KBgm3Dy/Pol1le0Lsu5LykXVBiMmpskot2IKJb27ZwdsoPwwAQMCpx0GODiva WMfgqSBWvbci6PZc63CvNiE69dE9RxkHFtwycxoNewXdWmhFkX/iThacNEZadbI0 rwlamvBz4kGM+Q4YiUaXlH9o4yIgfiLg5cWlZrl5SWiqltIgnHMEbHDKip5IvQla TtF6zKqFEvNZg3upRsdUfdtyxxEtNfSgXk+G40bi68QzX/F1x4Q=
    =Xq3C
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)