rpm package
opensuse/bcel&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/bcel&distro=openSUSE%20Tumbleweed
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-94114 | Med | 5.9 | < 6.13.0-1.1 | 6.13.0-1.1 | Oct 6, 2026 | Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apach | |
| CVE-2026-105111 | Med | 4.7 | < 6.13.0-1.1 | 6.13.0-1.1 | Oct 6, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker | |
| CVE-2022-42920 | Cri | 9.8 | < 5.2-37.1 | 5.2-37.1 | Nov 7, 2022 | Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controlla |
- affected < 6.13.0-1.1fixed 6.13.0-1.1
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apach
- affected < 6.13.0-1.1fixed 6.13.0-1.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker
- affected < 5.2-37.1fixed 5.2-37.1
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controlla