CVE-2022-42920
Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
- State
- Published
- Severity
- Not scored
- Published
- Nov 7, 2022
- Updated
- Aug 3, 2024
- Reserved
- Oct 14, 2022
Description
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Scores
The record has no CVSS score.
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
Apache Commons BCELApache Software Foundation |
|
References
- https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4
- [oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingmailing-list
- FEDORA-2022-01a56f581cvendor-advisory
- FEDORA-2022-0e358addb8vendor-advisory
- FEDORA-2022-f60a52e054vendor-advisory
- GLSA-202401-25vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.