USN-3747-1: OpenJDK 10 vulnerabilities
It was discovered that OpenJDK did not properly validate types in some situations. An attacker could use this to construct a Java class that could possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826) It was discovered that the PatternSyntaxException class in OpenJDK did not properly validate arguments passed to it. An attacker could use this to potentially construct a class that caused a denial of service (excessive memory consumption). (CVE-2018-2952) Daniel Bleichenbacher discovered a vulnerability in the Galois/Counter Mode (GCM) mode of operation for symmetric block ciphers in OpenJDK. An attacker could use this to expose sensitive information. (CVE-2018-2972)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-3747-1?
The severity of USN-3747-1 is high.
Which software is affected by USN-3747-1?
OpenJDK version 10.0.2+13-1ubuntu0.18.04.1 is affected by USN-3747-1.
What are the vulnerabilities addressed by USN-3747-1?
The vulnerabilities addressed by USN-3747-1 are CVE-2018-2825 and CVE-2018-2826.
How can an attacker exploit USN-3747-1?
An attacker can exploit USN-3747-1 by constructing a Java class that may bypass sandbox restrictions.
Where can I find more information about USN-3747-1?
You can find more information about USN-3747-1 at the following references: [CVE-2018-2825](https://ubuntu.com/security/CVE-2018-2825), [CVE-2018-2826](https://ubuntu.com/security/CVE-2018-2826), [CVE-2018-2952](https://ubuntu.com/security/CVE-2018-2952).