Gregor Samsa: Exploiting Java's XML Signature Verification
Google Project Zero researcher Felix Wilhelm found CVE-2022-34169, an integer truncation bug in a custom JIT compiler inside Java's standard library that processes untrusted XSLT programs during XML signature verification, leading to arbitrary code...