IBM JDK 7 SR11 (7.0.11.0), 7.1 SR5 (7.1.5.0), and 8 SR7 (8.0.7.0) fix a flaw in OpenJ9 VM described by upstream as:
In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
References:
https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities#IBMSecurityUpdateNovember2021 https://bugs.eclipse.org/bugs/showbug.cgi?id=576395 https://github.com/eclipse-openj9/openj9/pull/13740 https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/104
IBM JDK 7 SR10 FP80 (7.0.10.80), 7.1 SR4 FP80 (7.1.4.80), 8 SR6 FP25 (8.0.6.25), and 11 SR10 (11.0.10.0) fix a flaw described by upstream as:
Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
References:
https://www.ibm.com/support/pages/node/6414721 https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities#IBMSecurityUpdateFebruary2021 https://bugs.eclipse.org/bugs/showbug.cgi?id=569763
A buffer overflow flaw was fixed in IBM JDK 6 SR16-FP25, 7 SR9-FP40, 7R1 SR3-FP40, and 8 SR3:
CVEID: CVE-2016-0264 DESCRIPTION: A buffer overflow vulnerability in the IBM JVM facilitates arbitrary code execution under certain limited circumstances. CVSS Base Score: 5.6 CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
http://www-01.ibm.com/support/docview.wss?uid=swg21980826
External Reference:
http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateApril2016
IBM JDK 8 SR6 (8.0.6.0) fixes a flaw described by upstream as:
Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system, caused by the failure to performs an authorization check when an actor attempts to access a resource or perform an action. An attacker could exploit this vulnerability to gain access to diagnostic operations such as causing a GC or creating a diagnostic file.
OpenJ9 upstream bug:
https://bugs.eclipse.org/bugs/showbug.cgi?id=552129
References:
https://www.ibm.com/support/pages/node/1120071 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateNovember2019
IBM JDK 8 SR5 FP20 (8.0.5.20), 7 R1 SR4 FP30 (7.1.4.30), 7 SR10 FP30 (7.0.10.30), and 6 SR16 FP70 (6.0.16.70) fix a flaw described by upstream as:
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) does not protect against path traversal attacks when extracting compressed dump files.
References:
https://www-01.ibm.com/support/docview.wss?uid=ibm10719653 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateAugust2018
The following flaw was reported for IBM JDK:
A flaw in the IBM J9 JVM allows code to invoke non-public interface methods under certain circumstances. Untrusted code could potentially exploit this. This could lead to sensitive data being exposed to an attacker, or the attacker being able to inject bad data.
http://www-01.ibm.com/support/docview.wss?uid=swg21974193 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateJanuary2016
This flaw could allow an untrusted Java application or applet to bypass certain Java sandbox restrictions.
Issue was fixed in IBM JDK 6 SR16-FP20, 7 SR9-FP30, 7R1 SR3-FP30, and 8 SR2-FP10.
IBM JDK updates 7R1 SR2-FP10, 7 SR8-FP10, 6R1 SR8-FP3, 6 SR16-FP3 and 5.0 SR16-FP9 correct an unspecified vulnerability identified using CVE-2014-8891. Upstream has rated this issue with CVSSv2 score of 6.8 (no vector provided).
http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateFebruary2015
Further details of the issue should be made available via the following link:
http://www.ibm.com/support/docview.wss?uid=swg21695747
IBM JDK updates 7R1 SR2-FP10, 7 SR8-FP10, 6R1 SR8-FP3, 6 SR16-FP3 and 5.0 SR16-FP9 correct an unspecified vulnerability identified using CVE-2014-8892. Upstream has rated this issue with CVSSv2 score of 4.3 (no vector provided).
http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateFebruary2015
Further details of the issue should be made available via the following link:
http://www.ibm.com/support/docview.wss?uid=swg21695747