USN-3875-1 openjdk-8, openjdk-lts vulnerability

It was discovered that a memory disclosure issue existed in the OpenJDK Library subsystem. An attacker could use this to expose sensitive information and possibly bypass Java sandbox restrictions. CVE-2019-2422...

Insecure Connection

wildfly-iiop-openjdk is vulnerable to insecure connections. The library does not properly enforce the configuration when SSL is required, leading to insecure plaintext connections when the setting is enabled...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. The security component of OpenJDK incorrectly uses unsigned manifest attribute entries. This allows an attacker and an untrusted Java application or applet to bypass the protections provided by Jar signing...

Denial Of Service (DoS)

java-1.8.0-openjdk is vulnerable to denial of service DoS attacks. The vulnerability exists through a vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Concurrency. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Ja...

Unauthorised Modification

The java-1.8.0-openjdk packages is vulnerable to unauthorised modification. The vulnerability exists because it accepts ECSDA signatures using non-canonical DER encoding, leading to accept incorrect format not accepted by other cryptographic tools...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. An improper type safety check was discovered in the Hotspot component. An untrusted Java application or applet could use this flaw to bypass Java Sandbox restrictions...

Privilege Escalation

java-1.7.0-openjdk is vulnerable to privilege escalation attacks. The vulnerability exists as through sandboxed Java Web Start applications and sandboxed Java applets.Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vecto...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. An unspecified vulnerability allows remote attacks and untrusted Java applications or applets to bypass certain Java sandbox restrictions to perform unauthorized actions...

Directory Traversal

openjdk is vulnerable to directory traversal. A remote attacker is able to create or overwrite arbitrary files on the system using a malicious JAR archive containing files with ../ characters. The malicious file operations will be performed when the JAR archive is extracted...

Arbitrary Code Execution

openjdk is vulnerable to arbitrary code execution attacks. The vulnerability exists through an unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availabili...

Remote Code Execution (RCE)

openjdk is vulnerable to remote code execution RCE. An integer overflow occurs when the 2D component processes malicious sample model instances, allowing a remote attacker to corrupt memory and execute arbitrary code with virtual machine privileges...

Arbitrary Code Execution

openjdk is vulnerable to arbitrary code execution attacks. The vulnerability exists as a format string flaw was discovered in the Hotspot component event logger in OpenJDK. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine or, potentially, execute...

Sandbox Restrictions Bypass

openjdk is vulnerable to sandbox restrictions bypass. Improper permission checks allow an untrusted Java application or applet to bypass Java sandbox restrictions and perform unauthorized actions...

Cross-site Scripting (XSS)

openjdk is vulnerable to an unspecified vulnerability. The vulnerability affects client deployment of Java, and allows remote attackers to affect integrity via vectors related to RMI...

Code Injection

openjdk is vulnerable to code injection attacks. The vulnerability exists as jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation...

Insecure Authorization

openjdk is vulnerable to insecure authorization. The 2D component created shared memory segments with insecure permissions, allowing a local attacker to exploit the vulnerability to read or write to the shared memory segment...

Authorization Bypass

OpenJDK is vulnerable to authorization bypass. An improper permission check in the reflection API allows a remote attacker to bypass the Java sandbox restrictions and obtain unauthorized access to resources...

Remote Code Execution (RCE)

OpenJDK is vulnerable to remote code execution. The vulnerability allows remote attackers to execute arbitrary code via unknown vectors related to AWT...

openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-43)

This update for java-180-openjdk to version 8u191 fixes the following issues : Security issues fixed : - CVE-2018-3136: Manifest better support bsc1112142 - CVE-2018-3139: Better HTTP Redirection bsc1112143 - CVE-2018-3149: Enhance JNDI lookups bsc1112144 - CVE-2018-3169: Improve field accesses...