REDHAT-BUG-2015308: Medium severity ORACLE OpenJDK vulnerability

Published Oct 18, 2021

Updated

A flaw was found in the way the BMPImageReader class implementation in the ImageIO component of OpenJDK handled memory allocations when processing uncompressed BMP images. A specially-crafted BMP image with a small size could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Oct 18, 2021

Data Sourced

via Red Hat·08:35 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to do to trigger this issue?

An attacker needs to provide a specially crafted uncompressed BMP image to an application that processes it using the affected OpenJDK ImageIO BMPImageReader implementation.

What is the likely impact on an affected application?

Processing the crafted image can cause excessive memory allocation even when the BMP file is small. This may exhaust available memory and terminate the Java application with an out-of-memory condition.

REDHAT-BUG-2015308: Medium severity ORACLE OpenJDK vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to do to trigger this issue?

What is the likely impact on an affected application?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to trigger this issue?

What is the likely impact on an affected application?