it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Markus Koschany <apo AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5256-1] bcel security update
- Date: Tue, 18 Oct 2022 18:04:55 +0000
- Authentication-results: mail.piratenpartei.de; dkim=none; spf=none (mail.piratenpartei.de: domain of "bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org" has no SPF policy when checking 82.195.75.100) smtp.mailfrom="bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org"; dmarc=none
- List-archive: https://lists.debian.org/msgid-search/Y07qx+GdchLtgMOK AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date :Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=Z44SmLpcQJWl7QhtvpDBiljB457kcdiPS4iGZ3SOhyE=; b=eF Or3mdLNMiELaQh+xVLTMtIJZqBL7urTQWSkeXCFxG8IDbJXWy9vOWs4PVoFwT8kYDc9oGEWosVsu5 HLb4n/JMJMec5rAT3oaDXSrTpCGP0e7BGDvlZD4RBZDF/amjBLS02i+d3X6Efj9fc+aT26Od0SUcj WBF6HHWyOoGoZLs4bK0fotdKxofv1sxtFsXOc+cQjrAzEraQyDLCnMjyPsXPmeeUZmv7cl8jel/w+ 0A9Ud8ZR6bobAjnhMHP21vqWeOSGr1Dj6wSnKQhK91j/lPx+p3cf/+ATxI+0Cfxlk8wA1DExbsbAd 2wpAE+JD6dvMbZvywQwyapaV6lksq20w==;
- Old-return-path: <apo AT seger.debian.org>
- Priority: urgent
- Resent-date: Tue, 18 Oct 2022 18:21:16 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <FnNh6zoQ9KL.A.yy.c6uTjB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5256-1 security AT debian.org
https://www.debian.org/security/ Markus Koschany
October 18, 2022 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : bcel
CVE ID : CVE-2022-34169
Debian Bug : 1015860
The Apache Xalan Java XSLT library is vulnerable to an integer truncation
issue
when processing malicious XSLT stylesheets. This can be used to corrupt Java
class files generated by the internal XSLTC compiler and execute arbitrary
Java
bytecode. In Debian the vulnerable code is in the bcel source package.
For the stable distribution (bullseye), this problem has been fixed in
version 6.5.0-1+deb11u1.
We recommend that you upgrade your bcel packages.
For the detailed security status of bcel please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/bcel
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmNO6lRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeTIKg//T0o2OkmBcft4GuG7wPVTi1AgkDbxn+p541zijZ3w/ec6kBa/AznCaLpV
jv8Jf2ZSLeMqI+fXbcHkCF2P9P27Cj8mkheVa+OxxAiLnklG1nBaYnjsigYEkdYC
j4jt1hLpNX8Z1U8pxdbX7spmshWgZMBprRndKOMXD2xvbW7VvPz/oA47EcHsWmaB
xdepMt8aLsPyhvX3LrNTB5Fb9Dsx4EaRM20kVVzm+benT9U4CH9WsQNQotxeJ2LI
P7CNzkC6RXMG9mfXr2HyYhRD/Uid+bp+hJEzRkbpwwaqqvDXOOJEoNbzn3sNLRep
xnK/XnJ2K70iU3DWI6QBojoa2yb/7KmoicbUdScojTrpZClBvs35k+MtA/TCD6wE
A8anUiv2d4cnJ5lJdW7Wzuzzs7G4TF440p+NPY1AbCmQhhlLGJqU2ZrMl1qPfNfN
KL0KBgm3Dy/Pol1le0Lsu5LykXVBiMmpskot2IKJb27ZwdsoPwwAQMCpx0GODiva
WMfgqSBWvbci6PZc63CvNiE69dE9RxkHFtwycxoNewXdWmhFkX/iThacNEZadbI0
rwlamvBz4kGM+Q4YiUaXlH9o4yIgfiLg5cWlZrl5SWiqltIgnHMEbHDKip5IvQla
TtF6zKqFEvNZg3upRsdUfdtyxxEtNfSgXk+G40bi68QzX/F1x4Q=
=Xq3C
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5256-1] bcel security update, Markus Koschany, 18.10.2022
Archiv bereitgestellt durch MHonArc 2.6.24.