Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
References
Configurations
History
21 Nov 2024, 07:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2022/11/07/2 - Mailing List, Third Party Advisory | |
| References | () https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4 - Mailing List, Vendor Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ/ - | |
| References | () https://security.gentoo.org/glsa/202401-25 - |
17 Jan 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
|
| References |
|
08 Nov 2022, 04:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-07 13:15
Updated : 2024-11-21 07:25
NVD link : CVE-2022-42920
Mitre link : CVE-2022-42920
CVE.ORG link : CVE-2022-42920
JSON object : View
Products Affected
apache
- commons_bcel
fedoraproject
- fedora
CWE
CWE-787
Out-of-bounds Write