CVE-2019-2762: Medium severity Oracle JDK vulnerability
It was discovered that the implementation of the Throwable class in the Utilities component of OpenJDK did not sufficiently validate serial stream before deserializing suppressed exceptions. A specially-crafted input could cause a Java application to construct inconsistent object and possibly use an excessive amount of system resources when deserialized.
Other sources
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-2762?
The severity of CVE-2019-2762 is medium with a CVSS score of 5.3.
How can I fix the vulnerability CVE-2019-2762?
To fix the vulnerability CVE-2019-2762, you should update to the following versions: Java SE: 12.0.2+9-1 or later, Java SE Embedded: 8u211 or later.
Which versions of Oracle Java SE are affected by CVE-2019-2762?
The affected versions of Oracle Java SE are Java SE: 7u221, 8u212, 11.0.3, and 12.0.1.
Are there any official advisories or references for CVE-2019-2762?
Yes, you can refer to the following advisories: [Oracle Security Advisory](http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html), [Ubuntu Security Notice 4080-1](https://usn.ubuntu.com/4080-1/), [Ubuntu Security Notice 4083-1](https://usn.ubuntu.com/4083-1/).
What software packages are affected by CVE-2019-2762?
The affected software packages are openjdk-12 and openjdk-8 on Ubuntu, Oracle JDK and Oracle JRE, Canonical Ubuntu Linux, openSUSE Leap, Debian Debian Linux, Redhat Satellite, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, McAfee ePolicy Orchestrator, and Hp Xp7 Command View.