CVE-2022-42920

2022-11-0700:00:00

ubuntu.com

apache commons bcel

out-of-bounds

arbitrary bytecode

update

security issue

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.019

Percentile

88.8%

JSON

Apache Commons BCEL has a number of APIs that would normally only allow
changing specific class characteristics. However, due to an out-of-bounds
writing issue, these APIs can be used to produce arbitrary bytecode. This
could be abused in applications that pass attacker-controllable data to
those APIs, giving the attacker more control over the resulting bytecode
than otherwise expected. Update to Apache Commons BCEL 6.6.0.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchbcel< anyUNKNOWN
ubuntu20.04noarchbcel< anyUNKNOWN
ubuntu22.04noarchbcel< anyUNKNOWN
ubuntu16.04noarchbcel< anyUNKNOWN