SUSE CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...

SUSE CVE-2020-11722

Dungeon Crawl Stone Soup aka DCSS or crawl before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file...

SUSE CVE-2021-41041

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles...

SUSE CVE-2022-34169

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

SUSE CVE-2022-42920

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those...

Security Bulletin: IBM CICS TX Advanced is vulnerable to allowing a remote attacker to bypass security restrictions (CVE-2021-41041).

Summary IBM CICS TX Advanced could allow a remote attacker to bypass security restrictions. The fix removes this vulnerability CVE-2021-41041 from IBM CICS TX Advanced. Vulnerability Details CVEID:CVE-2021-41041 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

Security Bulletin: IBM Sterling Control Center is vulnerable to security bypass due to Eclipse Openj9 (CVE-2022-3676)

Summary IBM Sterling Control Center uses Eclipse Openj9 which could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allo...

Security Bulletin: CVE-2022-3676 may affect IBM TXSeries for Multiplatforms

Summary Eclipse Openj9 with IBM Java could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted request using bytecode, an attacker could exploit this vulnerability to access or modify memory. This...

EulerOS 2.0 SP8 : bcel (EulerOS-SA-2023-1307)

According to the versions of the bcel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds...

Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing

An out-of-bounds OOB write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected...

Important: Red Hat Security Advisory: Migration Toolkit for Runtimes security update

An update is now available for Migration Toolkit for Runtimes v1.0.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Amazon Linux 2022 : bcel, bcel-javadoc (ALAS2022-2023-275)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-275 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitra...

Important: bcel

Issue Overview: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllab...

Amazon Linux AMI : bcel (ALAS-2023-1668)

The version of bcel installed on the remote host is prior to 5.2-7.2.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1668 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an...

Amazon Linux 2 : bcel (ALAS-2023-1916)

The version of bcel installed on the remote host is prior to 5.2-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1916 advisory. Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an...

openSUSE 15: java-1_8_0-openj9 / java-1_8_0-openj9-accessibility / etc (SUSE-SU-2022:3092-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3092-1 advisory. - Updated to OpenJDK 8u345 build 01 with OpenJ9 0.33.0 virtual machine: - CVE-2022-34169: Fixed an integer truncation issue in the Xalan Java XSLT...

bcel security update

6.4.1-9 - Fix arbitrary bytecode produced via out-of-bounds writing - Resolves: CVE-2022-42920...

Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing

An out-of-bounds OOB write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected...

Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing

An out-of-bounds OOB write flaw was found in Apache Commons BCEL API. This flaw can be used to produce arbitrary bytecode and may abuse applications that pass attacker-controlled data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected...

bcel security update

An update is available for bcel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Byte Code Engineering Library Apache Commons BCEL is intended to give users ...