openSUSE-SU-2026:22109-1

openSUSE-SU-2026:22109-1 · Security update for bcel

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

На странице показана часть фактов из источников. Полное описание и список затронутых версий приведены в связанных бюллетенях.

This update for bcel fixes the following issues: - CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400). - CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399). Changes for bcel: - Update to version 6.13.0 * New Features + Add support for permitted subclasses + Add RecordComponentInfo.getAttribute(byte tag) + Add Const.MAJOR_27 + Add Const.MINOR_27 + Add and use ArrayType.isElementType(Type) + Add Const.MAJOR_28 + Add Const.MINOR_28 * Fixed Bugs + Fix constant pool module access test on Java 26 and above + Deprecate org.apache.bcel.classfile.Utility.Utility() + Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable) + Fix all Javadoc warnings and enforce checks by default + Escape constant pool names in generated HTML + Escape referenced names in BCELFactory Java output + Make wide flag thread-local in Utility.codeToString + Read multianewarray dimensions as unsigned byte + Site docs: clarify security model + Read ConstantDynamic indices as unsigned shorts + Validate index upper bound in CPInstruction, IINC and RET setIndex + Use correct attribute tag in NestHost and ModuleMainClass + Propagate runtime-visible flag when parsing parameter annotations + Use fixedLength for parsed LOOKUPSWITCH length + Fix ConstantPoolGen dedup key collisions for names with delimiters + Read unsigned bytecode operands in CodeHTML disassembler + Deep-copy bootstrap arguments array in BootstrapMethod.copy() + Use exclusive live-range end in LocalVariableTable .getLocalVariable + Build TABLESWITCH from sorted arrays in SWITCH + Use array element type not basic type for primitive array access + Set length in INVOKEDYNAMIC constructor + Reject CALOAD on non-char arrays in structural verification + Add negative verifier tests for remaining array load/store component type checks + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY + Match wide local variable instruction length to dumped bytes + Bound IINC increment to signed short + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8 + Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser + Nested annotation element values recurse unboundedly; MAX_ARRAY_DIMENSIONS cap bypassed + Opcodes tableswitch and lookupswitch add boundary checks + JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class + JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations + Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains + Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b + Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths + Disassembler and Class2HTML re-implement the unchecked switch-table allocation + ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle + Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies + Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114) + Silent u2/u1 count truncation across dump paths corrupts emitted bytecode + Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111) + Class2HTML builds output file paths from the unvalidated class name + ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field + PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence + Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate) + Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE + BCELifier interpolates attacker class/package names into generated Java source unescaped + Verifier pass 3a delayed checks are quadratic in attribute and code size + Verifier cache grows unboundedly with attacker-chosen class names + Static WIDE ThreadLocal survives exceptions, corrupting the next class's disassembly on the same thread + Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent non-canonical aliasing * Changes + Bump org.apache.commons:commons-parent from 95 to 104 + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20 + Bump commons-io:commons-io from 2.21.0 to 2.22.0 + Bump jna.version from 5.18.1 to 5.19.1 + [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0 - Changes of version 6.12.0 + Add Const.MAJOR_26 + Add Const.MINOR_26 + Fix infinite loop in example.TransitiveHull + Fix Apache RAT plugin console warnings + Fix malformed Javadoc comments + Make the build reproducible on the Azul JDK + Fix infinite loop in JavaClass.findField() on invalid input + Fix infinite loop in JavaClass.getAllInterfaces() on invalid input + Fix infinite loop in JavaClass.getSuperClasses() on invalid + Exception message in Args.requireU4() refers to the wrong data type + Exception message in Args.requireU2() refers to the wrong upper range value + Code.Code(int, int, DataInput, ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.Code(int, int, int, int, byte[], CodeException[], Attribute[], ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.setCode(byte[]) now throws a ClassFormatException if the code array is greater than the JVM specification allows + ClassDumper.dump() should not call the input stream it didn't open; fixes IOException when calling DumpClass.main (ClassDumper.java:351) + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses varagrs: ConstantPool(Constant...) + org.apache.bcel.classfile.Deprecated now requires its the attribute_length item be zero + org.apache.bcel.classfile.Synthetic now requires its the + The size of an Attribute unknown to the JVM specification is limited to 1 MB and is overridden with the system property BCEL.Attribute.Unknown.max_attribute_length + Bump org.apache.commons:commons-parent from 89 to 95 + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0 + Bump commons-io:commons-io from 2.20.0 to 2.21.0 + Bump commons-lang3 from 3.19.0 to 3.20.0 + [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0 - Changes of version 6.11.0 + Add Const.MAJOR_25 + Add Const.MINOR_25 + Add experimental CycloneDX VEX file + Refactor to use new Maven POM variable ecj.version + Replace internal use of Locale.ENGLISH with Locale.ROOT + BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz distribution file + BCEL-376: ClassPath.close() throws UnsupportedOperationException when created with system-classpath + ClassPath.getResources(String) can use an ArrayList instead of a Vector + Fix SpotBugs [ERROR] Medium: Operation on the "created" shared variable in "ConstantUtf8" class is not atomic [org.apache .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the "considered" shared variable in "ConstantUtf8" class is not atomic [org .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java: [line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the "skipped" shared .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134] + org.apache.bcel.util.ClassPath .addJdkModules(String, List<String>) now reads the system property "jdk.module.path" instead of "java.modules.path" + Fix ConstantPoolModuleAccessTest failures on Java 25 + 377: Fix testing on Java 24 and up + Bump org.apache.commons:com

Есть исправление

Опубликовано

2026-10-16T12:21:25Z

Обновлено

2026-10-19T17:23:15.937624643Z

Стек: system

Проверьте свой сервер →