{"id":"AZL-109475","summary":"CVE-2022-42920 affecting package bcel 5.2-37","details":"Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.","modified":"2026-10-24T05:31:11Z","published":"2022-11-07T13:15:10Z","upstream":["CVE-2022-42920"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42920"}],"affected":[{"package":{"name":"bcel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/bcel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2-37"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109475.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}