Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bcel | Jan 5, 2023 | Nov 7, 2022 |
| Amazon Linux Ami 2 | — | Upgrade bcel-javadocUpgrade bcel | Jan 24, 2023 | Nov 7, 2022 |
| Amazon_linux | — | Upgrade bcel | Jan 25, 2023 | Nov 7, 2022 |
| Centos_linux | — | Upgrade bcelUpgrade bcel-javadoc | Dec 14, 2022 | Nov 7, 2022 |
| Debian | — | Upgrade bcel | Jul 30, 2024 | Nov 7, 2022 |
| Gentoo Linux | — | Upgrade dev-java/bcel.Upgrade dev-java/openjdk-jre-bin.Upgrade dev-java/openjdk.Upgrade dev-java/openjdk-bin. | Jan 18, 2024 | Nov 7, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade bcel | Jun 9, 2023 | Nov 7, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bcel | Feb 9, 2023 | Nov 7, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 35893811 for version 12.2.1.4.0. | Jan 17, 2023 | Nov 7, 2022 |
| Oracle_linux | — | Upgrade bcel-javadocUpgrade bcel | Dec 14, 2022 | Nov 4, 2022 |
| Red Hat Jboss Eap | — | — | Aug 15, 2025 | Nov 4, 2022 |
| Redhat_linux | — | Upgrade bcelUpgrade bcel-javadoc | Dec 14, 2022 | Nov 7, 2022 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 7, 2022 |
| Suse | — | Upgrade bcel | Dec 2, 2022 | Nov 7, 2022 |
| Ubuntu | — | Upgrade libbcel-java (Ubuntu Pro)Upgrade libbcel-java | Jan 17, 2025 | Nov 7, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub