Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA63108
HistoryJan 16, 2024 - 12:00 a.m.

KLA63108 Multiple vulnerabilities in Oracle Java SE and GraalVM

2024-01-1600:00:00
Kaspersky Lab
threats.kaspersky.com
18
oracle
java
graalvm
vulnerability
denial of service
sensitive information
arbitrary code
public exploits
jdk 17.0.9
jdk 21.0.1
enterprise edition
20.3.12
21.3.8
22.3.4
11.0.21
17.0.9
21.0.1
8u391
8u391-perf
update
ace impact

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.1 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.706 High

EPSS

Percentile

97.9%

JSON

Detect date:

01/16/2024

Severity:

High

Description:

Multiple vulnerabilities were found in Oracle Java. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Oracle GraalVM for JDK 17.0.9, 21.0.1
Oracle GraalVM Enterprise Edition 20.3.12, 21.3.8, 22.3.4
Oracle Java SE 11.0.21, 17.0.9, 21.0.1, 8u391, 8u391-perf

Solution:

Update to the latest version
Download Java

Original advisories:

Oracle Critical Patch Update Advisory – January 2024

Impacts:

ACE

Related products:

Oracle Java JRE 1.8.x

CVE-IDS:

CVE-2023-444875.0Warning
CVE-2023-50725.0Warning
CVE-2024-209215.0Warning
CVE-2024-209225.0Warning
CVE-2024-209325.0Warning
CVE-2024-209455.0Warning
CVE-2024-209235.0Warning
CVE-2024-209195.0Warning
CVE-2024-209185.0Warning
CVE-2024-209255.0Warning
CVE-2024-209555.0Warning
CVE-2024-209265.0Warning
CVE-2024-209525.0Warning

References

Related

nessus 67
amazon 3
debian 3
openvas 24
osv 12
redhat 27
ubuntu 4
ibm 38
almalinux 5
oraclelinux 7
f5 2
centos 2
mageia 2
atlassian 1
cloudlinux 1
aix 1
nessus
nessus
Amazon Corretto Java 8.x < 8.402.06.1 Multiple Vulnerabilities
2024-01-16 00:00:00
Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2024-484)
2024-01-18 00:00:00
Oracle Java SE Multiple Vulnerabilities (January 2024 CPU)
2024-01-17 00:00:00
amazon
amazon
Important: java-11-amazon-corretto
2024-01-17 00:55:00
Important: java-17-amazon-corretto
2024-01-17 00:55:00
Important: java-1.8.0-openjdk
2024-02-01 19:57:00
debian
debian
[SECURITY] [DSA 5613-1] openjdk-17 security update
2024-02-01 22:39:37
[SECURITY] [DLA 3728-1] openjdk-11 security update
2024-01-31 15:32:31
[SECURITY] [DSA 5604-1] openjdk-11 security update
2024-01-23 21:53:52
openvas
openvas
openSUSE: Security Advisory for java (SUSE-SU-2024:0325-1)
2024-03-04 00:00:00
Debian: Security Advisory (DSA-5613-1)
2024-02-02 00:00:00
SUSE: Security Advisory (SUSE-SU-2024:0203-1)
2024-01-25 00:00:00
osv
osv
openjdk-17 - security update
2024-02-01 00:00:00
Important: java-11-openjdk security update
2024-01-18 00:00:00
openjdk-17 vulnerabilities
2024-02-27 02:04:18
redhat
redhat
(RHSA-2024:0228) Important: java-1.8.0-openjdk security update
2024-01-17 16:41:40
(RHSA-2024:0235) Important: java-11-openjdk security update
2024-01-17 16:38:15
(RHSA-2024:0226) Important: java-1.8.0-openjdk security and bug fix update
2024-01-17 15:24:39
ubuntu
ubuntu
OpenJDK 8 vulnerabilities
2024-03-18 00:00:00
OpenJDK 11 vulnerabilities
2024-02-27 00:00:00
OpenJDK 17 vulnerabilities
2024-02-27 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM Java SDK may affect IBM Storage Scale
2024-04-29 09:30:18
Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to multiple issues due to IBM Semeru Runtime
2024-03-12 09:26:18
Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to multiple issues due to IBM Runtime Environment Java Technology Edition
2024-03-12 09:21:46
almalinux
almalinux
Important: java-11-openjdk security update
2024-01-18 00:00:00
Important: java-17-openjdk security and bug fix update
2024-01-17 00:00:00
Important: java-1.8.0-openjdk security and bug fix update
2024-01-17 00:00:00
oraclelinux
oraclelinux
java-11-openjdk security update
2024-01-17 00:00:00
java-1.8.0-openjdk security and bug fix update
2024-01-23 00:00:00
java-1.8.0-openjdk security and bug fix update
2024-01-17 00:00:00
f5
f5
K000138850 : OpenJDK vulnerabilities CVE-2024-20918, CVE-2024-20925, CVE-2024-20945, CVE-2024-20952, and CVE-2024-20955
2024-03-07 00:00:00
K000138851 : OpenJDK vulnerabilities CVE-2024-20921, CVE-2024-20926, and CVE-2024-20932
2024-03-07 00:00:00
centos
centos
java security update
2024-01-26 18:11:41
java security update
2024-01-26 18:12:38
mageia
mageia
Updated java 1.8.0, 11 & latest packages fix security vulnerabilities
2024-03-15 05:49:05
Updated java-17-openjdk packages fix security vulnerabilities
2024-03-14 02:14:37
atlassian
atlassian
Bundled JRE in Bitbucket 8.16+ is vulnerable to OpenJDK vulnerabilities CVE-2024-20918, CVE-2024-20919
2024-04-22 06:45:05
cloudlinux
cloudlinux
java-1.8.0-openjdk: Fix of 8 CVEs
2024-01-31 10:50:31
aix
aix
Multiple vulnerabilities in IBM Java SDK affect AIX
2024-03-07 15:16:48

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.1 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.706 High

EPSS

Percentile

97.9%

JSON
Related for KLA63108
nessus67amazon3debian3openvas24osv12redhat27ubuntu4ibm38almalinux5oraclelinux7f52centos2mageia2atlassian1cloudlinux1aix1