CVE catalog

CVE-2022-34169

bcel: CVE-2022-34169

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: Jul 19, 2022, 8:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 81.76% · Oct 25, 2026

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	bcel	sid	`6.13.0-1`	fixed
Debian	bcel	forky	`6.10.0-1`	fixed
Debian	bcel	trixie	`6.10.0-1`	fixed
Debian	bcel	bookworm	`6.5.0-2`	fixed
Debian	openjdk-17	sid	`17.0.21+9-1`	fixed
Debian	openjdk-17	bookworm	`17.0.19+10-1~deb12u2`	fixed
Debian	openjdk-17	bookworm-security	`17.0.21+9-1~deb12u1`	fixed
Suse	bcel	linux enterprise module for basesystem 15 sp5	`6.10.0-150200.11.6.2`	fixed
Suse	xalan-j2	linux enterprise module for basesystem 15 sp5	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise module for basesystem 15 sp5	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise module for basesystem 15 sp6	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise module for basesystem 15 sp6	`6.10.0-150200.11.6.2`	fixed
Suse	xalan-j2	linux enterprise module for basesystem 15 sp6	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise module for basesystem 15 sp6	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise module for development tools 15 sp5	`3.16.0-150200.3.9.2`	fixed
Suse	netty3	linux enterprise module for development tools 15 sp5	`3.10.6-150200.3.13.2`	fixed
Suse	netty3	linux enterprise module for development tools 15 sp6	`3.10.6-150200.3.13.2`	fixed
Suse	apache-commons-lang3	manager server module 4.3	`3.16.0-150200.3.9.2`	fixed
Suse	apache-commons-lang3	linux enterprise high performance computing 15 sp2-ltss	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise high performance computing 15 sp2-ltss	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise high performance computing 15 sp2-ltss	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise high performance computing 15 sp2-ltss	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise high performance computing 15 sp2-ltss	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise high performance computing 15 sp3-ltss	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise high performance computing 15 sp3-ltss	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise high performance computing 15 sp3-ltss	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise high performance computing 15 sp3-ltss	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise high performance computing 15 sp3-ltss	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise high performance computing 15 sp4-espos	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise high performance computing 15 sp4-espos	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise high performance computing 15 sp4-espos	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise high performance computing 15 sp4-espos	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise high performance computing 15 sp4-espos	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise high performance computing 15 sp4-ltss	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise high performance computing 15 sp4-ltss	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise high performance computing 15 sp4-ltss	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise high performance computing 15 sp4-ltss	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise high performance computing 15 sp4-ltss	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise server 15 sp2-ltss	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise server 15 sp2-ltss	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise server 15 sp2-ltss	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise server 15 sp2-ltss	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise server 15 sp2-ltss	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise server 15 sp3-ltss	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise server 15 sp3-ltss	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise server 15 sp3-ltss	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise server 15 sp3-ltss	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise server 15 sp3-ltss	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise server 15 sp4-ltss	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise server 15 sp4-ltss	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise server 15 sp4-ltss	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise server 15 sp4-ltss	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise server 15 sp4-ltss	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise server for sap applications 15 sp2	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise server for sap applications 15 sp2	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise server for sap applications 15 sp2	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise server for sap applications 15 sp2	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise server for sap applications 15 sp2	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise server for sap applications 15 sp3	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise server for sap applications 15 sp3	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise server for sap applications 15 sp3	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise server for sap applications 15 sp3	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise server for sap applications 15 sp3	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	linux enterprise server for sap applications 15 sp4	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	linux enterprise server for sap applications 15 sp4	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	linux enterprise server for sap applications 15 sp4	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	linux enterprise server for sap applications 15 sp4	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	linux enterprise server for sap applications 15 sp4	`2.12.2-150200.3.10.2`	fixed
Suse	bcel	manager proxy 4.3	`6.10.0-150200.11.6.2`	fixed
Suse	xalan-j2	manager proxy 4.3	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	manager proxy 4.3	`2.12.2-150200.3.10.2`	fixed
Suse	bcel	manager server 4.3	`6.10.0-150200.11.6.2`	fixed
Suse	xalan-j2	manager server 4.3	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	manager server 4.3	`2.12.2-150200.3.10.2`	fixed
Suse	apache-commons-lang3	enterprise storage 7.1	`3.16.0-150200.3.9.2`	fixed
Suse	bcel	enterprise storage 7.1	`6.10.0-150200.11.6.2`	fixed
Suse	netty3	enterprise storage 7.1	`3.10.6-150200.3.13.2`	fixed
Suse	xalan-j2	enterprise storage 7.1	`2.7.3-150200.11.7.1`	fixed
Suse	xerces-j2	enterprise storage 7.1	`2.12.2-150200.3.10.2`	fixed
Opensuse	apache-commons-lang3	leap 15.5	`3.16.0-150200.3.9.2`	fixed
Opensuse	bcel	leap 15.5	`6.10.0-150200.11.6.2`	fixed
Opensuse	mojo-parent	leap 15.5	`82-150200.3.10.1`	fixed
Opensuse	netty3	leap 15.5	`3.10.6-150200.3.13.2`	fixed
Opensuse	xalan-j2	leap 15.5	`2.7.3-150200.11.7.1`	fixed
Opensuse	xalan-j2-extras	leap 15.5	`2.7.3-150200.11.7.1`	fixed
Opensuse	xerces-j2	leap 15.5	`2.12.2-150200.3.10.2`	fixed
Opensuse	apache-commons-lang3	leap 15.6	`3.16.0-150200.3.9.2`	fixed
Opensuse	bcel	leap 15.6	`6.10.0-150200.11.6.2`	fixed
Opensuse	mojo-parent	leap 15.6	`82-150200.3.10.1`	fixed
Opensuse	netty3	leap 15.6	`3.10.6-150200.3.13.2`	fixed
Opensuse	xalan-j2	leap 15.6	`2.7.3-150200.11.7.1`	fixed
Opensuse	xalan-j2-extras	leap 15.6	`2.7.3-150200.11.7.1`	fixed
Opensuse	xerces-j2	leap 15.6	`2.12.2-150200.3.10.2`	fixed
Opensuse	xalan-j2	tumbleweed	`2.7.3-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	bcel	source	sid	`6.5.0-2`	not yet assigned	Not reported	[1015860]
Debian	bcel	source	forky	`6.5.0-2`	not yet assigned	Not reported	[1015860]
Debian	bcel	source	trixie	`6.5.0-2`	not yet assigned	Not reported	[1015860]
Debian	bcel	source	bookworm	`6.5.0-2`	not yet assigned	Not reported	[1015860]
Debian	openjdk-17	source	sid	`17.0.4+8-1`	not yet assigned	Not reported	Not reported
Debian	openjdk-17	source	bookworm	`17.0.4+8-1`	not yet assigned	Not reported	Not reported
Suse	bcel	rpm	linux enterprise module for basesystem 15 sp5	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise module for basesystem 15 sp5	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise module for basesystem 15 sp5	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise module for basesystem 15 sp6	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise module for basesystem 15 sp6	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise module for basesystem 15 sp6	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise module for basesystem 15 sp6	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise module for development tools 15 sp5	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise module for development tools 15 sp5	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise module for development tools 15 sp6	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	manager server module 4.3	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise high performance computing 15 sp2-ltss	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise high performance computing 15 sp2-ltss	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise high performance computing 15 sp2-ltss	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise high performance computing 15 sp2-ltss	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise high performance computing 15 sp2-ltss	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise high performance computing 15 sp3-ltss	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise high performance computing 15 sp3-ltss	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise high performance computing 15 sp3-ltss	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise high performance computing 15 sp3-ltss	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise high performance computing 15 sp3-ltss	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise high performance computing 15 sp4-espos	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise high performance computing 15 sp4-espos	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise high performance computing 15 sp4-espos	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise high performance computing 15 sp4-espos	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise high performance computing 15 sp4-espos	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise high performance computing 15 sp4-ltss	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise high performance computing 15 sp4-ltss	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise high performance computing 15 sp4-ltss	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise high performance computing 15 sp4-ltss	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise high performance computing 15 sp4-ltss	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise server 15 sp2-ltss	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise server 15 sp2-ltss	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise server 15 sp2-ltss	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise server 15 sp2-ltss	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise server 15 sp2-ltss	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise server 15 sp3-ltss	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise server 15 sp3-ltss	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise server 15 sp3-ltss	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise server 15 sp3-ltss	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise server 15 sp3-ltss	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise server 15 sp4-ltss	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise server 15 sp4-ltss	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise server 15 sp4-ltss	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise server 15 sp4-ltss	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise server 15 sp4-ltss	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise server for sap applications 15 sp2	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise server for sap applications 15 sp2	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise server for sap applications 15 sp2	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise server for sap applications 15 sp2	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise server for sap applications 15 sp2	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise server for sap applications 15 sp3	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise server for sap applications 15 sp3	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise server for sap applications 15 sp3	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise server for sap applications 15 sp3	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise server for sap applications 15 sp3	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	linux enterprise server for sap applications 15 sp4	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	linux enterprise server for sap applications 15 sp4	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	linux enterprise server for sap applications 15 sp4	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	linux enterprise server for sap applications 15 sp4	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	linux enterprise server for sap applications 15 sp4	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	manager proxy 4.3	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	manager proxy 4.3	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	manager proxy 4.3	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	manager server 4.3	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	manager server 4.3	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	manager server 4.3	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	apache-commons-lang3	rpm	enterprise storage 7.1	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	bcel	rpm	enterprise storage 7.1	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	netty3	rpm	enterprise storage 7.1	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xalan-j2	rpm	enterprise storage 7.1	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Suse	xerces-j2	rpm	enterprise storage 7.1	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	apache-commons-lang3	rpm	leap 15.5	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	bcel	rpm	leap 15.5	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	mojo-parent	rpm	leap 15.5	`82-150200.3.10.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	netty3	rpm	leap 15.5	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xalan-j2	rpm	leap 15.5	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xalan-j2-extras	rpm	leap 15.5	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xerces-j2	rpm	leap 15.5	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	apache-commons-lang3	rpm	leap 15.6	`3.16.0-150200.3.9.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	bcel	rpm	leap 15.6	`6.10.0-150200.11.6.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	mojo-parent	rpm	leap 15.6	`82-150200.3.10.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	netty3	rpm	leap 15.6	`3.10.6-150200.3.13.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xalan-j2	rpm	leap 15.6	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xalan-j2-extras	rpm	leap 15.6	`2.7.3-150200.11.7.1`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xerces-j2	rpm	leap 15.6	`2.12.2-150200.3.10.2`	Not reported	SUSE-RU-2024:3971-1	Not reported
Opensuse	xalan-j2	rpm	tumbleweed	`2.7.3-1.1`	Not reported	OPENSUSE-SU-2024:13189-1	Not reported

[Debian bug #1015860]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libbcel-java]Fixed
Source package: [bcel]
Details (2)
- 6.5.0-2 · all · bookworm
  Fixed · Fixed: 6.5.0-2
  dsa · bcel · debian · bookworm
- 6.5.0-2 · all · bookworm
  Fixed · Fixed: 6.5.0-2
  dsa · bcel · debian · bookworm
[libbcel-java-doc]Fixed
Source package: [bcel]
Details (2)
- 6.5.0-2 · all · bookworm
  Fixed · Fixed: 6.5.0-2
  dsa · bcel · debian · bookworm
- 6.5.0-2 · all · bookworm
  Fixed · Fixed: 6.5.0-2
  dsa · bcel · debian · bookworm
[openjdk-17-dbg]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-demo]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-doc]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · all · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · all · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-jdk]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-jdk-headless]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-jre]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-jre-headless]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-jre-zero]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
[openjdk-17-source]Fixed
Source package: [openjdk-17]
Details (4)
- 17.0.19+10-1~deb12u2 · all · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.19+10-1~deb12u2 · all · bookworm
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm
- 17.0.20.1+1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 17.0.4+8-1
  dsa · openjdk-17 · debian · bookworm

[openSUSE Tumbleweed]

[xalan-j2]Fixed
Source package: [xalan-j2]
Details (1)
- 2.7.3-4.5 · noarch · tumbleweed
  Fixed · Fixed: 2.7.3-1.1
  dsa · xalan-j2 · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:27:55 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]