USN-6931-1: OpenJDK 17 vulnerabilities
It was discovered that the Hotspot component of OpenJDK 17 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-21131) It was discovered that the Hotspot component of OpenJDK 17 could be made to run into an infinite loop. If an automated system were tricked into processing excessively large symbols, an attacker could possibly use this issue to cause a denial of service. (CVE-2024-21138) It was discovered that the Hotspot component of OpenJDK 17 did not properly perform range check elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-21140) Sergey Bylokhov discovered that OpenJDK 17 did not properly manage memory when handling 2D images. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-21145) It was discovered that the Hotspot component of OpenJDK 17 incorrectly handled memory when performing range check elimination under certain circumstances. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-21147)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openjdk-17-jdkto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jdk-headlessto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jreto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jre-headlessto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jre-zeroto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jdkto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jdk-headlessto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jreto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jre-headlessto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jre-zeroto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jdkto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jdk-headlessto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jreto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jre-headlessto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-17-jre-zeroto a version that resolves this vulnerability.Fixed in 17.0.12+7-1ubuntu2~20.04 - Upgrade
Upgrade
OpenJDK 17to a version that resolves this vulnerability.Patch USN-6931-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6931-1?
The vulnerability USN-6931-1 has a high severity rating due to its potential for causing denial of service or executing arbitrary code.
How do I fix USN-6931-1?
To fix USN-6931-1, upgrade to the specified version of OpenJDK 17 which is 17.0.12+7-1ubuntu2~24.04 or later.
Which software packages are affected by USN-6931-1?
Affected packages include openjdk-17-jdk, openjdk-17-jdk-headless, openjdk-17-jre, and openjdk-17-jre-headless on Ubuntu versions 20.04, 22.04, and 24.04.
What can an attacker achieve with USN-6931-1?
An attacker could exploit USN-6931-1 to cause a denial of service or potentially execute arbitrary code on the affected system.
On which Ubuntu versions is USN-6931-1 a concern?
USN-6931-1 impacts Ubuntu 20.04, 22.04, and 24.04 for specific OpenJDK 17 packages.