Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-34169: The Xalan Java XSLT library has an integer truncation issue when processing malicious stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. CVE-2022-21541: MethodHandle.invokeBasic() method can be accessed on byte code level from an arbitrary class. CVE-2022-21540: Generated code produced by C1 may leak a package-private class to a class from a different package.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | java-11-amazon-corretto | 1:11.0.16+8-1.amzn2 |
| Amazon Linux · 2 | java-11-amazon-corretto-headless | 1:11.0.16+8-1.amzn2 |
| Amazon Linux · 2 | java-11-amazon-corretto-javadoc | 1:11.0.16+8-1.amzn2 |
Vulnerabilities 3
-
High 7.5
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …