CVE-2019-2422: Low severity Oracle JDK vulnerability
A memory disclosure flaw was found in the FileChannelImpl class in the Libraries component of OpenJDK. An untrusted Java application or applet could use this flaw leak limited amount of Java Virtual Machine memory possibly containing sensitive information, resulting in a partial bypass of Java sandbox restrictions.
Other sources
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-2422?
CVE-2019-2422 is a vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries).
Which versions of Java SE are affected by CVE-2019-2422?
Java SE: 7u201, 8u192, and 11.0.1 are the supported versions affected by CVE-2019-2422.
What is the severity of CVE-2019-2422?
CVE-2019-2422 has a severity rating of 3.1, which is considered medium severity.
How can an attacker exploit CVE-2019-2422?
Exploiting CVE-2019-2422 requires a difficult-to-exploit vulnerability that allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE.
How can I remediate CVE-2019-2422?
To remediate CVE-2019-2422, update Oracle Java SE to the latest version available for your supported version: 7u201, 8u192, or 11.0.1.