Skip to content
OpenAdvisories
Critical USN-7208-1 1 CVE

bcel vulnerability

Published Jan 16, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Felix Wilhelm discovered that Apache Commons BCEL APIs
incorrectly handled parameters due to a memory issue. An
attacker supplying malicious input could exploit this to
generate and execute arbitrary bytecode.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS bcel 6.5.0-1ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS bcel 6.0~rc3-2ubuntu1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS bcel 6.2-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS bcel 6.4.1-1ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2022-42920

    Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

    Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pa…

    Apache Software Foundation Apache Commons BCEL bcel bcel Debian Ubuntu Azure Linux Maven

References

  • report
    https://ubuntu.com/security/CVE-2022-42920