Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-bcel | Jan 5, 2023 | Nov 7, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-bcelamazon-linux-ami-2-upgrade-bcel-javadoc | Jan 24, 2023 | Nov 7, 2022 | |
| Amazon_linux | — | amazon-linux-upgrade-bcel | Jan 25, 2023 | Nov 7, 2022 |
| Centos_linux | — | centos-upgrade-bcelcentos-upgrade-bcel-javadoc | Dec 14, 2022 | Nov 7, 2022 |
| Debian | debian-upgrade-bcel | Jul 30, 2024 | Nov 7, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-java-bcelgentoo-linux-upgrade-dev-java-openjdkgentoo-linux-upgrade-dev-java-openjdk-bingentoo-linux-upgrade-dev-java-openjdk-jre-bin | Jan 18, 2024 | Nov 7, 2022 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-bcel | Jun 9, 2023 | Nov 7, 2022 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-bcel | Feb 9, 2023 | Nov 7, 2022 | |
| Oracle Weblogic | oracle-weblogic-oct-2023-cpu-12_2_1_4_0oracle-weblogic-oct-2023-cpu-14_1_1_0_0 | Jan 17, 2023 | Jan 17, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-bceloracle-linux-upgrade-bcel-javadoc | Dec 14, 2022 | Nov 4, 2022 |
| Redhat_linux | redhat-upgrade-bcelredhat-upgrade-bcel-javadoc | Dec 14, 2022 | Nov 7, 2022 | |
| Suse | — | suse-upgrade-bcel | Dec 2, 2022 | Nov 7, 2022 |
| Ubuntu | ubuntu-pro-upgrade-libbcel-javaubuntu-upgrade-libbcel-java | Jan 17, 2025 | Nov 7, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub