IBM JDK 7 R1 SR5 FP20 (7.1.5.20) and 8 SR8 FP15 (8.0.8.15) fix a flaw described by upstream as:
Eclipse OpenJ9 is vulnerable to a denial of service, caused by a flaw when a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause an infinite busy hang on a spinlock or a segmentation fault.
OpenJ9 upstream references: https://github.com/eclipse-openj9/openj9/pull/18085 https://gitlab.eclipse.org/security/cve-assignement/-/issues/13
IBM JDK references: https://www.ibm.com/support/pages/node/7078433 https://www.ibm.com/support/pages/apar/IJ49075 https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities#IBMSecurityUpdateNovember2023
A flaw was discovered in the CORBA component of OpenJDK in the way it performed deserialization of IOR (Interoperable Object Reference) string objects. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
A flaw was found in the PKIX certification path validation algorithm in the JSSE component of OpenJDK. A malicious remote client could use this flaw to craft a X.509 certificate and cause denial of service in a Java application processing such certificate.
IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.
IBM JDK 8 SR5 FP20 (8.0.5.20), 7 R1 SR4 FP30 (7.1.4.30), 7 SR10 FP30 (7.0.10.30), and 6 SR16 FP70 (6.0.16.70) fix a flaw described by upstream as:
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) does not protect against path traversal attacks when extracting compressed dump files.
References:
https://www-01.ibm.com/support/docview.wss?uid=ibm10719653 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateAugust2018
IBM JDK versions 6.0.16.45, 7.0.10.5, 7.1.4.5, and 8.0.4.5 correct a security issue described by upstream as:
CVEID: CVE-2017-1289 DESCRIPTION: IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. CVSS Base Score: 8.2 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/125150 for the current score CVSS Environmental Score: Undefined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)
References:
https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateMay2017 http://www-01.ibm.com/support/docview.wss?uid=swg22002169 https://exchange.xforce.ibmcloud.com/vulnerabilities/125150
An information leak flaw was found in the IBM JDK Java Security Components. Upstream security bulletin describes the issue as:
IBM Java Security Components could allow an attacker with physical access to the system to obtain sensitive information from the Kerberos Credential Cache.
References:
http://www-01.ibm.com/support/docview.wss?uid=swg21969225 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateNovember2015
The class file parser in IBM Java before 1.4.2 SR13 FP9, as used in IBM Runtimes for Java Technology 5.0.0 before SR13 and 6.0.0 before SR10, allows remote authenticated users to cause a denial of service (JVM segmentation fault, and possibly memory consumption or an infinite loop) via a crafted attribute length field in a class file, which triggers a buffer over-read.
Unspecified vulnerability in the XML component in IBM Runtimes for Java Technology 5.0.0 before SR10 has unknown impact and attack vectors, related to the "updated version of XML4J 4.4.17."