openSUSE 16 Security Update : bcel (openSUSE-SU-2026:22109-1)

high Nessus Plugin ID 367232

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22109-1 advisory.

- CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser (bsc#1284400).
- CVE-2026-105111: Class2HTML emits unescaped class strings, enabling stored XSS (bsc#1284399).

Changes for bcel:

- Update to version 6.13.0
* New Features + Add support for permitted subclasses + Add RecordComponentInfo.getAttribute(byte tag) + Add Const.MAJOR_27 + Add Const.MINOR_27 + Add and use ArrayType.isElementType(Type) + Add Const.MAJOR_28 + Add Const.MINOR_28
* Fixed Bugs + Fix constant pool module access test on Java 26 and above + Deprecate org.apache.bcel.classfile.Utility.Utility() + Deprecate org.apache.bcel.verifier.exc.Utility .getStackTrace(Throwable) + Fix all Javadoc warnings and enforce checks by default + Escape constant pool names in generated HTML + Escape referenced names in BCELFactory Java output + Make wide flag thread-local in Utility.codeToString + Read multianewarray dimensions as unsigned byte + Site docs: clarify security model + Read ConstantDynamic indices as unsigned shorts + Validate index upper bound in CPInstruction, IINC and RET setIndex + Use correct attribute tag in NestHost and ModuleMainClass + Propagate runtime-visible flag when parsing parameter annotations + Use fixedLength for parsed LOOKUPSWITCH length + Fix ConstantPoolGen dedup key collisions for names with delimiters + Read unsigned bytecode operands in CodeHTML disassembler + Deep-copy bootstrap arguments array in BootstrapMethod.copy() + Use exclusive live-range end in LocalVariableTable .getLocalVariable + Build TABLESWITCH from sorted arrays in SWITCH + Use array element type not basic type for primitive array access + Set length in INVOKEDYNAMIC constructor + Reject CALOAD on non-char arrays in structural verification + Add negative verifier tests for remaining array load/store component type checks + Validate u1 count bound in INVOKEINTERFACE and MULTIANEWARRAY + Match wide local variable instruction length to dumped bytes + Bound IINC increment to signed short + Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ConstantUtf8 + Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser + Nested annotation element values recurse unboundedly;
MAX_ARRAY_DIMENSIONS cap bypassed + Opcodes tableswitch and lookupswitch add boundary checks + JustIce Pass 2 hangs on cyclic superclass chain of a referenced exception class + JustIce Pass 2 LVT check amplifies each 10-byte entry into ~131k hashtable operations + Pass 3b dataflow stores frames per instruction and clones ever-growing execution chains + Cubic handlers * range * subroutines scan in Subroutines constructor hangs JustIce Pass 3b + Subroutines.noRecursiveCalls enumerates exponentially many JSR call paths + Disassembler and Class2HTML re-implement the unchecked switch-table allocation + ConstantPool.constantToString recurses forever on self-referencing CONSTANT_MethodHandle + Utility.typeSignatureToString recurses per generic-nesting level, unbounded, with quadratic substring copies + Repositories cache classes under the input-defined this_class name; global static Repository/VerifierFactory make the poisoning ClassLoader-wide (bsc#1284400, CVE-2026-94114) + Silent u2/u1 count truncation across dump paths corrupts emitted bytecode + Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports) (bsc#1284399, CVE-2026-105111) + Class2HTML builds output file paths from the unvalidated class name + ClassPath.getBytes() sizes its buffer from the forged ZIP uncompressed-size field + PMG attribute ignores declared length, enabling BCEL-vs-JVM parse divergence + Signature.matchGJIdent recurses unboundedly on nested generic signatures (Signature.translate) + Utility.decode fixed 3x buffer breaks the encode/decode round trip and throws unchecked AIOOBE + BCELifier interpolates attacker class/package names into generated Java source unescaped + Verifier pass 3a delayed checks are quadratic in attribute and code size + Verifier cache grows unboundedly with attacker-chosen class names + Static WIDE ThreadLocal survives exceptions, corrupting the next class's disassembly on the same thread + Utility.JavaReader escape decoding: OOB table index, bad-hex crash, silent non-canonical aliasing
* Changes + Bump org.apache.commons:commons-parent from 95 to 104 + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.3.0 to 2.4.20 + Bump commons-io:commons-io from 2.21.0 to 2.22.0 + Bump jna.version from 5.18.1 to 5.19.1 + [test] Bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0
- Changes of version 6.12.0 + Add Const.MAJOR_26 + Add Const.MINOR_26 + Fix infinite loop in example.TransitiveHull + Fix Apache RAT plugin console warnings + Fix malformed Javadoc comments + Make the build reproducible on the Azul JDK + Fix infinite loop in JavaClass.findField() on invalid input + Fix infinite loop in JavaClass.getAllInterfaces() on invalid input + Fix infinite loop in JavaClass.getSuperClasses() on invalid + Exception message in Args.requireU4() refers to the wrong data type + Exception message in Args.requireU2() refers to the wrong upper range value + Code.Code(int, int, DataInput, ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.Code(int, int, int, int, byte[], CodeException[], Attribute[], ConstantPool) now throws a ClassFormatException if the code array is greater than the JVM specification allows + Code.setCode(byte[]) now throws a ClassFormatException if the code array is greater than the JVM specification allows + ClassDumper.dump() should not call the input stream it didn't open; fixes IOException when calling DumpClass.main (ClassDumper.java:351) + org.apache.bcel.classfile.ConstantPool.ConstantPool(Constant[]) now uses varagrs: ConstantPool(Constant...) + org.apache.bcel.classfile.Deprecated now requires its the attribute_length item be zero + org.apache.bcel.classfile.Synthetic now requires its the + The size of an Attribute unknown to the JVM specification is limited to 1 MB and is overridden with the system property BCEL.Attribute.Unknown.max_attribute_length + Bump org.apache.commons:commons-parent from 89 to 95 + [test] Bump org.jetbrains.kotlin:kotlin-stdlib from 2.2.20 to 2.3.0 + Bump commons-io:commons-io from 2.20.0 to 2.21.0 + Bump commons-lang3 from 3.19.0 to 3.20.0 + [test] Bump org.apache.commons:commons-exec from 1.5.0 to 1.6.0
- Changes of version 6.11.0 + Add Const.MAJOR_25 + Add Const.MINOR_25 + Add experimental CycloneDX VEX file + Refactor to use new Maven POM variable ecj.version + Replace internal use of Locale.ENGLISH with Locale.ROOT + BCEL-375: Wrong permissions on bcel .jar file in binary .tar.gz distribution file + BCEL-376: ClassPath.close() throws UnsupportedOperationException when created with system-classpath + ClassPath.getResources(String) can use an ArrayList instead of a Vector + Fix SpotBugs [ERROR] Medium: Operation on the created shared variable in ConstantUtf8 class is not atomic [org.apache .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 119] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the considered shared variable in ConstantUtf8 class is not atomic [org .apache.bcel.classfile.ConstantUtf8] At ConstantUtf8.java:
[line 137] AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE + Fix SpotBugs [ERROR] Medium: Operation on the skipped shared .bcel.classfile.ConstantUtf8] At ConstantUtf8.java:[line 134] + org.apache.bcel.util.ClassPath .addJdkModules(String, List<String>) now reads the system property jdk.module.path instead of java.modules.path + Fix ConstantPoolModuleAccessTest failures on Java 25 + 377: Fix testing on Java 24 and up + Bump org.apache.commons:commons-parent from 72 to 89 + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.19.0 + Bump org.jetbrains.kotlin:kotlin-stdlib from 2.0.0 to 2.2.20 + Bump commons-io:commons-io from 2.16.1 to 2.20.0 + Bump jna.version from 5.14.0 to 5.18.1 + Bump org.codehaus.mojo:taglist-maven-plugin from 3.1.0 to 3.2.1 + Bump org.apache.commons:commons-collections4 from 4.5.0-M2 to 4.5.0 + Bump org.apache.commons:commons-exec from 1.4.0 to 1.5.0 a minimum of Java 8 + Fix PMD UnnecessaryFullyQualifiedName + Fix PMD EmptyCatchBlock by allowing commented blocks + Fix PMD EmptyControlStatement by allowing commented blocks JasminVisitor + SpotBugs checks should ignore code generated by JavaCC + Fix SpotBugs URF_UNREAD_FIELD in ClassDumper + Fix SpotBugs DM_DEFAULT_ENCODING in JasminVisitor ASTFunAppl Mini.Environment + Fix SpotBugs DM_DEFAULT_ENCODING in Mini.MiniC + Fix SpotBugs WMI_WRONG_MAP_ITERATOR in Package.go(String[]) TransitiveHull.getIgnored() + Add accessors to model and unit tests, Javadoc + Add Const.MAJOR_22 + Add Const.MINOR_22 + Add Const.MAJOR_23 + Add Const.MINOR_23 + Add Const.MAJOR_24 + Add Const.MINOR_24 2.0.0 to 4.5.0-M2 + Bump org.apache.commons:commons-parent from 69 to 71 3.1.0
* Includes changes from 6.9.0 Maintenance and bug fix release + Add Support for Java 16 records + Add null guard for InstructionFactory.createInvoke() + Avoid possible NullPointerException in org.apache.bcel.classfile.DescendingVisitor.accept(E[]) AnnotationEntryGen[]) ConstantPoolGen, boolean) ElementValue[], ConstantPoolGen) org.apache.bcel.generic.ClassGen.setMethods(Method[]) + Avoid possible NullPointerException in org.apache.bcel.generic .ClassGen.unpackAnnotations(Attribute[]) + Avoid possible NullPointerException in org.apache.bcel .classfile.ParameterAnnotationEntry .createParameterAnnotationEntries(Attribute[]) org.apache.bcel.generic.ClassGen.ClassGen(JavaClass) .FieldGenOrMethodGen.addAll(Attribute[]) + Avoid NullPointerException after calling org.apache.bcel .classfile.MethodParameters.setParameters(MethodParameter[]) with null .classfile.ParameterAnnotations .setParameterAnnotationTable(ParameterAnnotationEntry[]) .classfile.LocalVariableTypeTable .setLocalVariableTable(LocalVariable[]) with null .classfile.LocalVariableTable .classfile.LineNumberTable.setLineNumberTable(LineNumber[]) .classfile.JavaClass.setMethods(Method[] with null .classfile.JavaClass.setInterfaces(int[]) with null .classfile.JavaClass.setInterfaceNames(String[]) with null .classfile.JavaClass.setFields(Field[]) with null .classfile.JavaClass.setAttributes(Attribute[]) with null .classfile.ConstantPool.setConstantPool(Constant[]) with null .classfile.FieldOrMethod.setAttributes(Attribute[]) with null .classfile.Annotations.setAnnotationTable(AnnotationEntry[]) .classfile.ArrayElementValue.ArrayElementValue(int, ElementValue[], ConstantPool) with null .classfile.BootstrapMethod.BootstrapMethod(int, int[]) with null .classfile.BootstrapMethod.setBootstrapArguments(int[]) with .classfile.BootstrapMethods.BootstrapMethods(int, int, BootstrapMethod[], ConstantPool) with null .classfile.BootstrapMethods .setBootstrapMethods(BootstrapMethod[]) with null + Avoid NullPointerException calling org.apache.bcel.generic .InstructionList.redirectLocalVariables(LocalVariableGen[], InstructionHandle, InstructionHandle) with null .InstructionList.redirectExceptionHandlers(CodeExceptionGen[], .InstructionList.findHandle(InstructionHandle[], int[], int, int) with null .MethodGen.setArgumentTypes(Type[]) with null .MethodGen.setArgumentNames(String[]) with null .MethodGen.removeRuntimeAttributes(Attribute[]) with null .MethodGen.makeMutableVersion(AnnotationEntry[]) with null + Bump org.apache.commons:commons-parent from 66 to 69 + Bump org.jetbrains.kotlin:kotlin-stdlib from 1.9.22 to 1.9.23 + Bump commons-io:commons-io from 2.15.1 to 2.16.1
* 6.8.0 (2023-12-08) Maintenance and bug fix release ClassFormatException input Java4Example ~ Add verifier tests on some opcodes signatures ~ Add Const.MAJOR_20 ~ Add Const.MINOR_20 ~ Add Const.MAJOR_21 ~ Add Const.MINOR_21 ~ [Bcelifier] stackmap support to pass JDK verifier SE_BAD_FIELD BCELFactory.java:[lines 192-196] SF_SWITCH_FALLTHROUGH NullPointerException not a NullPointerException ~ Test and coverage of InstructionFactory ~ Verifier: test and coverage for SWAP instruction () in it`()' ~ Fix null pointers in AnnotationEntry supports package-private) test ATHROW on empty stack Select#toString(boolean) ~ Fix EmptyVisitorTestCase on Java 21 ~ Bump commons-parent from 54 to 65 ~ Bump jna.version from 5.12.1 to 5.13.0 ~ Bump kotlin-stdlib from 1.8.10 to 1.9.21 ~ Bump commons-io from 2.11.0 to 2.15.1 ~ Bump commons-lang3 from 3.12.0 to 3.14.0 3.1.1
* 6.7.0 (2022-11-28) Maintenance and bug fix release
* 6.6.1 (2022-10-29) Maintenance and bug fix release
* 6.6.0 (2022-10-08) Minor feature and bug fix release
* 6.5.0 (2020-06-05) Minor feature and bug fix release
* 6.4.1 (2019-09-26) Bug fix release
* 6.4.0 (2019-09-20) Feature and bug fix release requires Java 7 or higher to run class org.apache.bcel.generic.InstructionConsts class java.lang.String

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected bcel and / or bcel-javadoc packages.

Plugin Details

Severity: High

ID: 367232

File Name: openSUSE-2026-22109-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 10/19/2026

Updated: 10/19/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-94114

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:bcel-javadoc, p-cpe:/a:novell:opensuse:bcel

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/16/2026

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-105111, CVE-2026-94114

Detections

Analytics