Veracode Vulnerability DatabaseVERACODE:21720Denial Of Service (DoS)
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
OpenJDK is vulnerable to denial of service (DoS). The attack exists because it does not perform glyph bitmap image dimension check in FreetypeFontScaler.
References
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
access.redhat.com/errata/RHSA-2019:3128
access.redhat.com/errata/RHSA-2019:3134
access.redhat.com/errata/RHSA-2019:3135
access.redhat.com/errata/RHSA-2019:3136
access.redhat.com/errata/RHSA-2019:3157
access.redhat.com/errata/RHSA-2019:3158
access.redhat.com/security/updates/classification/#important
seclists.org/bugtraq/2019/Oct/27
seclists.org/bugtraq/2019/Oct/31
security.netapp.com/advisory/ntap-20191017-0001/
www.debian.org/security/2019/dsa-4546
www.debian.org/security/2019/dsa-4548
Related
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P