29/11/2023

USN-6528-1: OpenJDK 8 vulnerabilities

First published: Wed Nov 29 2023(Updated: )

It was discovered that the HotSpot VM implementation in OpenJDK did not properly validate bytecode blocks in certain situations. An attacker could possibly use this to cause a denial of service. (CVE-2022-40433) Carter Kozak discovered that OpenJDK, when compiling with AVX-512 instruction support enabled, could produce code that resulted in memory corruption in certain situations. An attacker targeting applications built in this way could possibly use this to cause a denial of service or execute arbitrary code. In Ubuntu, OpenJDK defaults to not using AVX-512 instructions. (CVE-2023-22025) It was discovered that the CORBA implementation in OpenJDK did not properly perform deserialization of IOR string objects. An attacker could possibly use this to bypass Java sandbox restrictions. (CVE-2023-22067) It was discovered that OpenJDK did not properly perform PKIX certification path validation in certain situations. An attacker could use this to cause a denial of service. (CVE-2023-22081)

Affected Software	Affected Version	How to fix
All of
ubuntu/openjdk-8-jdk	<8u392-ga-1~23.10	8u392-ga-1~23.10
	=23.10
All of
ubuntu/openjdk-8-jdk-headless	<8u392-ga-1~23.10	8u392-ga-1~23.10
	=23.10
All of
ubuntu/openjdk-8-jre	<8u392-ga-1~23.10	8u392-ga-1~23.10
	=23.10
All of
ubuntu/openjdk-8-jre-headless	<8u392-ga-1~23.10	8u392-ga-1~23.10
	=23.10
All of
ubuntu/openjdk-8-jre-zero	<8u392-ga-1~23.10	8u392-ga-1~23.10
	=23.10
All of
ubuntu/openjdk-8-jdk	<8u392-ga-1~23.04	8u392-ga-1~23.04
	=23.04
All of
ubuntu/openjdk-8-jdk-headless	<8u392-ga-1~23.04	8u392-ga-1~23.04
	=23.04
All of
ubuntu/openjdk-8-jre	<8u392-ga-1~23.04	8u392-ga-1~23.04
	=23.04
All of
ubuntu/openjdk-8-jre-headless	<8u392-ga-1~23.04	8u392-ga-1~23.04
	=23.04
All of
ubuntu/openjdk-8-jre-zero	<8u392-ga-1~23.04	8u392-ga-1~23.04
	=23.04
All of
ubuntu/openjdk-8-jdk	<8u392-ga-1~22.04	8u392-ga-1~22.04
	=22.04
All of
ubuntu/openjdk-8-jdk-headless	<8u392-ga-1~22.04	8u392-ga-1~22.04
	=22.04
All of
ubuntu/openjdk-8-jre	<8u392-ga-1~22.04	8u392-ga-1~22.04
	=22.04
All of
ubuntu/openjdk-8-jre-headless	<8u392-ga-1~22.04	8u392-ga-1~22.04
	=22.04
All of
ubuntu/openjdk-8-jre-zero	<8u392-ga-1~22.04	8u392-ga-1~22.04
	=22.04
All of
ubuntu/openjdk-8-jdk	<8u392-ga-1~20.04	8u392-ga-1~20.04
	=20.04
All of
ubuntu/openjdk-8-jdk-headless	<8u392-ga-1~20.04	8u392-ga-1~20.04
	=20.04
All of
ubuntu/openjdk-8-jre	<8u392-ga-1~20.04	8u392-ga-1~20.04
	=20.04
All of
ubuntu/openjdk-8-jre-headless	<8u392-ga-1~20.04	8u392-ga-1~20.04
	=20.04
All of
ubuntu/openjdk-8-jre-zero	<8u392-ga-1~20.04	8u392-ga-1~20.04
	=20.04
All of
ubuntu/openjdk-8-jdk	<8u392-ga-1~18.04	8u392-ga-1~18.04
	=18.04
All of
ubuntu/openjdk-8-jdk-headless	<8u392-ga-1~18.04	8u392-ga-1~18.04
	=18.04
All of
ubuntu/openjdk-8-jre	<8u392-ga-1~18.04	8u392-ga-1~18.04
	=18.04
All of
ubuntu/openjdk-8-jre-headless	<8u392-ga-1~18.04	8u392-ga-1~18.04
	=18.04
All of
ubuntu/openjdk-8-jre-zero	<8u392-ga-1~18.04	8u392-ga-1~18.04
	=18.04
All of
ubuntu/openjdk-8-jdk	<8u392-ga-1~16.04	8u392-ga-1~16.04
	=16.04
All of
ubuntu/openjdk-8-jdk-headless	<8u392-ga-1~16.04	8u392-ga-1~16.04
	=16.04
All of
ubuntu/openjdk-8-jre	<8u392-ga-1~16.04	8u392-ga-1~16.04
	=16.04
All of
ubuntu/openjdk-8-jre-headless	<8u392-ga-1~16.04	8u392-ga-1~16.04
	=16.04
All of
ubuntu/openjdk-8-jre-jamvm	<8u392-ga-1~16.04	8u392-ga-1~16.04
	=16.04
All of
ubuntu/openjdk-8-jre-zero	<8u392-ga-1~16.04	8u392-ga-1~16.04
	=16.04

Never miss a vulnerability like this again

Reference Links

Child vulnerabilities

(Contains the following vulnerabilities)

agent/description
agent/event
agent/first-publish-date
agent/last-modified-date
agent/references
agent/severity
agent/softwarecombine
agent/tags
agent/title
agent/type
collector/usn
source/Ubuntu
anchor-related/USN-6527-1
agent/software-canonical-lookup
package-manager/ubuntu
vendor/ubuntu
canonical/ubuntu ubuntu
version/ubuntu ubuntu/23.10
version/ubuntu ubuntu/23.04
version/ubuntu ubuntu/22.04
version/ubuntu ubuntu/20.04
version/ubuntu ubuntu/18.04
version/ubuntu ubuntu/16.04

USN-6528-1: OpenJDK 8 vulnerabilities

Never miss a vulnerability like this again

Reference Links

Child vulnerabilities

Company

Resources

Contact