Privilege Escalation

openjdk is vulnerable to privilege escalation. It was found that the Java launcher provided by OpenJDK did not check the LDLIBRARYPATH environment variable for insecure empty path elements. A local attacker able to trick a user into running the Java launcher while working from an attacker-writabl...

Authorization Bypass

java is vulnerable to authorization bypass. The vulnerability exists as the privileged accept method of the ServerSocket class in the Common Object Request Broker Architecture CORBA implementation in OpenJDK allowed it to receive connections from any host, instead of just the host of the current...

Access Restriction Bypass

java-openjdk is vulnerable to Access restriction bypass. Due to some flaws in the Java Virtual Machine JVM and in various Java class implementations, it allows an unsigned applet or application to bypass intended access restrictions...

Information Disclosure

openjdk is vulnerable to information disclosure. An information disclosure flaw was found in the way private Java variables were handled. An untrusted applet or application could use this flaw to obtain information from variables that would otherwise be private...

Authorization Bypass

openjdk is vulnerable to authorization bypass. It was discovered that JDK13Services grants unnecessary privileges to certain object types. This could be misused by an untrusted applet or application to use otherwise restricted functionality...

Authorization Bypass

openjdk is vulnerable to authorization bypass. It was discovered that OpenType checks can be bypassed. This could allow a rogue application to bypass access restrictions by acquiring references to privileged objects through finalizer resurrection...

Information Disclosure

openjdk is vulnerable to information disclosure. Several potential information leaks were found in various mutable static variables. These could be exploited in application scenarios that execute untrusted scripting code...

Denial Of Service (DoS)

lcms is vulnerable to denial of service DoS. The vulnerability exists as a memory leak flaw was found in LittleCMS embedded in OpenJDK. A application using color profiles could use excessive amounts of memory, and possibly crash after using all available memory, if used to open specially-crafted...

CVE-2020-2604

A flaw was found in the serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization...

[SECURITY] Fedora 32 Update: java-11-openjdk-11.0.6.10-0.fc32

The OpenJDK runtime environment...

Fedora: Security Advisory for java-11-openjdk (FEDORA-2020-07624ddb99)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RapidPayload - Metasploit Payload Generator

Framework RapidPayload - Metasploit Payload Generator Requirements OpenJDK 8 JAVA, or superiors versions. Metasploit Apktool Python3 Execution: git clone https://github.com/AngelSecurityTeam/RapidPayload cd RapidPayload bash install.sh python3 RapidPayload.py AngelSecurityTeam Download RapidPaylo...

Fedora: Security Advisory for java-1.8.0-openjdk (FEDORA-2020-42e79d74f1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 32 Update: java-1.8.0-openjdk-1.8.0.242.b08-1.fc32

The OpenJDK runtime environment 8...

Huawei EulerOS: Security Advisory for java-1.8.0-openjdk (EulerOS-SA-2020-1307)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2020-1403)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.251-2.6.21.0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1403 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

RHEL 6 : java-1.8.0-ibm (RHSA-2020:0856)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0856 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)

A flaw was found in the serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization...

OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols...