First published: Tue Apr 14 2020(Updated: )
A flaw was found in the boundary checks in the java.nio buffer classes in the Libraries component of OpenJDK, where it is bypassed in certain cases. This flaw allows an untrusted Java application or applet o bypass Java sandbox restrictions.
Credit: secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 |
redhat/java | <1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 | 1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 |
redhat/java | <1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 | 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 | 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 |
redhat/java | <1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 | 1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 |
redhat/java | <11-openjdk-1:11.0.7.10-4.el7_8 | 11-openjdk-1:11.0.7.10-4.el7_8 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 |
redhat/java | <1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 |
redhat/java | <11-openjdk-1:11.0.7.10-1.el8_1 | 11-openjdk-1:11.0.7.10-1.el8_1 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1.el8_2 | 1.8.0-ibm-1:1.8.0.6.10-1.el8_2 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 |
redhat/java | <11-openjdk-1:11.0.7.10-1.el8_0 | 11-openjdk-1:11.0.7.10-1.el8_0 |
Oracle JDK | =1.7.0-update251 | |
Oracle JDK | =1.8.0-update241 | |
Oracle JDK | =11.0.6 | |
Oracle JDK | =14.0.0 | |
Oracle JRE | =1.7.0-update_251 | |
Oracle JRE | =1.8.0-update_241 | |
Oracle JRE | =11.0.6 | |
Oracle JRE | =14.0.0 | |
Oracle OpenJDK | >=11<=11.0.6 | |
Oracle OpenJDK | >=13<=13.0.2 | |
Oracle OpenJDK | =7 | |
Oracle OpenJDK | =7-update1 | |
Oracle OpenJDK | =7-update10 | |
Oracle OpenJDK | =7-update101 | |
Oracle OpenJDK | =7-update11 | |
Oracle OpenJDK | =7-update111 | |
Oracle OpenJDK | =7-update121 | |
Oracle OpenJDK | =7-update13 | |
Oracle OpenJDK | =7-update131 | |
Oracle OpenJDK | =7-update141 | |
Oracle OpenJDK | =7-update15 | |
Oracle OpenJDK | =7-update151 | |
Oracle OpenJDK | =7-update161 | |
Oracle OpenJDK | =7-update17 | |
Oracle OpenJDK | =7-update171 | |
Oracle OpenJDK | =7-update181 | |
Oracle OpenJDK | =7-update191 | |
Oracle OpenJDK | =7-update2 | |
Oracle OpenJDK | =7-update201 | |
Oracle OpenJDK | =7-update21 | |
Oracle OpenJDK | =7-update211 | |
Oracle OpenJDK | =7-update221 | |
Oracle OpenJDK | =7-update231 | |
Oracle OpenJDK | =7-update241 | |
Oracle OpenJDK | =7-update25 | |
Oracle OpenJDK | =7-update251 | |
Oracle OpenJDK | =7-update3 | |
Oracle OpenJDK | =7-update4 | |
Oracle OpenJDK | =7-update40 | |
Oracle OpenJDK | =7-update45 | |
Oracle OpenJDK | =7-update5 | |
Oracle OpenJDK | =7-update51 | |
Oracle OpenJDK | =7-update55 | |
Oracle OpenJDK | =7-update6 | |
Oracle OpenJDK | =7-update60 | |
Oracle OpenJDK | =7-update65 | |
Oracle OpenJDK | =7-update67 | |
Oracle OpenJDK | =7-update7 | |
Oracle OpenJDK | =7-update72 | |
Oracle OpenJDK | =7-update76 | |
Oracle OpenJDK | =7-update80 | |
Oracle OpenJDK | =7-update85 | |
Oracle OpenJDK | =7-update9 | |
Oracle OpenJDK | =7-update91 | |
Oracle OpenJDK | =7-update95 | |
Oracle OpenJDK | =7-update97 | |
Oracle OpenJDK | =7-update99 | |
Oracle OpenJDK | =8 | |
Oracle OpenJDK | =8-update101 | |
Oracle OpenJDK | =8-update102 | |
Oracle OpenJDK | =8-update11 | |
Oracle OpenJDK | =8-update111 | |
Oracle OpenJDK | =8-update112 | |
Oracle OpenJDK | =8-update121 | |
Oracle OpenJDK | =8-update131 | |
Oracle OpenJDK | =8-update141 | |
Oracle OpenJDK | =8-update151 | |
Oracle OpenJDK | =8-update152 | |
Oracle OpenJDK | =8-update161 | |
Oracle OpenJDK | =8-update162 | |
Oracle OpenJDK | =8-update171 | |
Oracle OpenJDK | =8-update172 | |
Oracle OpenJDK | =8-update181 | |
Oracle OpenJDK | =8-update191 | |
Oracle OpenJDK | =8-update192 | |
Oracle OpenJDK | =8-update20 | |
Oracle OpenJDK | =8-update201 | |
Oracle OpenJDK | =8-update202 | |
Oracle OpenJDK | =8-update211 | |
Oracle OpenJDK | =8-update212 | |
Oracle OpenJDK | =8-update221 | |
Oracle OpenJDK | =8-update231 | |
Oracle OpenJDK | =8-update241 | |
Oracle OpenJDK | =8-update25 | |
Oracle OpenJDK | =8-update31 | |
Oracle OpenJDK | =8-update40 | |
Oracle OpenJDK | =8-update45 | |
Oracle OpenJDK | =8-update5 | |
Oracle OpenJDK | =8-update51 | |
Oracle OpenJDK | =8-update60 | |
Oracle OpenJDK | =8-update65 | |
Oracle OpenJDK | =8-update66 | |
Oracle OpenJDK | =8-update71 | |
Oracle OpenJDK | =8-update72 | |
Oracle OpenJDK | =8-update73 | |
Oracle OpenJDK | =8-update74 | |
Oracle OpenJDK | =8-update77 | |
Oracle OpenJDK | =8-update91 | |
Oracle OpenJDK | =8-update92 | |
Oracle OpenJDK | =14 | |
NetApp 7-Mode Transition Tool | ||
Netapp Active Iq Unified Manager Windows | >=7.3 | |
Netapp Active Iq Unified Manager Vsphere | >=9.5 | |
Netapp Cloud Backup | ||
Netapp E-series Performance Analyzer | ||
NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.2 | |
Netapp E-series Santricity Web Services Web Services Proxy | ||
NetApp OnCommand Insight | ||
NetApp OnCommand Workflow Automation | ||
Netapp Plug-in For Symantec Netbackup | ||
Netapp Santricity Unified Manager | ||
Netapp Snapmanager Sap | ||
Netapp Snapmanager Oracle | ||
Netapp Steelstore Cloud Integrated Storage | ||
Netapp Storagegrid | >=9.0.0<=9.0.4 | |
Netapp Storagegrid | ||
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
Fedoraproject Fedora | =30 | |
Fedoraproject Fedora | =31 | |
Fedoraproject Fedora | =32 | |
openSUSE Leap | =15.1 | |
openSUSE Leap | =15.2 | |
Canonical Ubuntu Linux | =16.04 | |
Canonical Ubuntu Linux | =18.04 | |
Canonical Ubuntu Linux | =19.10 | |
IBM Engineering Requirements Quality Assistant On-Premises | <=All | |
debian/openjdk-11 | 11.0.24+8-2~deb11u1 11.0.25~5ea-1 | |
debian/openjdk-8 | 8u422-b05-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2020-2803 is a vulnerability in the Java SE and Java SE Embedded product of Oracle Java SE that allows an unauthenticated attacker with network access.
The affected versions of Java SE are 7u251, 8u241, 11.0.6, and 14.
The affected version of Java SE Embedded is 8u241.
The severity of CVE-2020-2803 is high with a severity value of 7.
To fix the CVE-2020-2803 vulnerability, update to the following versions: Java SE 7u252, 8u252, 11.0.7, and 14.0.1.