USN-6932-1: OpenJDK 21 vulnerabilities
It was discovered that the Hotspot component of OpenJDK 21 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-21131) It was discovered that the Hotspot component of OpenJDK 21 could be made to run into an infinite loop. If an automated system were tricked into processing excessively large symbols, an attacker could possibly use this issue to cause a denial of service. (CVE-2024-21138) It was discovered that the Hotspot component of OpenJDK 21 did not properly perform range check elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-21140) Sergey Bylokhov discovered that OpenJDK 21 did not properly manage memory when handling 2D images. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-21145) It was discovered that the Hotspot component of OpenJDK 21 incorrectly handled memory when performing range check elimination under certain circumstances. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2024-21147)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openjdk-21-jdkto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jdk-headlessto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jreto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-headlessto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-zeroto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~24.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jdkto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jdk-headlessto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jreto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-headlessto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-zeroto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~22.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jdkto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jdk-headlessto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jreto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-headlessto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~20.04 - Upgrade
Upgrade
ubuntu/openjdk-21-jre-zeroto a version that resolves this vulnerability.Fixed in 21.0.4+7-1ubuntu2~20.04
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6932-1?
The severity of USN-6932-1 is significant, leading to potential denial of service or execution of arbitrary code.
How do I fix USN-6932-1?
To fix USN-6932-1, upgrade to OpenJDK version 21.0.4+7-1ubuntu2~24.04 or later.
Which versions of Ubuntu are affected by USN-6932-1?
USN-6932-1 affects Ubuntu versions 20.04, 22.04, and 24.04 with specific OpenJDK package versions.
Can USN-6932-1 lead to remote code execution?
Yes, the vulnerability described in USN-6932-1 can potentially be exploited for remote code execution.
What is the cause of the vulnerability in USN-6932-1?
The USN-6932-1 vulnerability is caused by improper bounding of certain UTF-8 strings in the Hotspot component of OpenJDK 21.