Bug#1016975: libxerces2-java: CVE-2022-23437

[Moritz Mühlenhoff]

Source: libxerces2-java
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for libxerces2-java.

CVE-2022-23437[0]:
| There's a vulnerability within the Apache Xerces Java (XercesJ) XML
| parser when handling specially crafted XML document payloads. This
| causes, the XercesJ XML parser to wait in an infinite loop, which may
| sometimes consume system resources for prolonged duration. This
| vulnerability is present within XercesJ version 2.12.1 and the
| previous versions.

https://www.openwall.com/lists/oss-security/2022/01/24/3


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-23437
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23437

Please adjust the affected versions in the BTS as needed.