Oracle Java SE 6u75, 7u55 and 8u5 fixes an unspecified vulnerability in the Deployment component (CVE-2014-2428). Upstream has CVSSv2 scored this issue as: 7.6/AV:N/AC:H/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
Oracle Java SE 5.0u75, 6u75, 7u55 and 8u5 fixes an unspecified vulnerability in the 2D component (CVE-2014-2401). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
It was discovered that MethodHandle did not properly handle variable argument lists when permuting or dropping arguments. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the AlgorithmChecker and SignatureAndHashAlgorithm classes did not properly prevent the SIGNATUREPRIMITIVESET set from being modified. An untrusted Java application or applet could possibly use this flaw to alter the content of the SIGNATUREPRIMITIVESET set.
Oracle Java SE 7u55 and 8u5 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0448). Upstream has CVSSv2 scored this issue as: 7.6/AV:N/AC:H/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication.
Two new network system properties are introduced as part of the fix which restrict HTTP authentication schemes that can be used for authentication to proxy depending on whether proxied request is HTTP or HTTPS:
- jdk.http.auth.proxying.disabledSchemes lists authentication schemes that can not be used for proxy authentication when proxying HTTP request. No schemes are disabled by default.
- jdk.http.auth.tunneling.disabledSchemes lists authentication schemes that can not be used for proxy authentication when proxying HTTPS request (using HTTP CONNECT method). The 'Basic' HTTP authentication scheme is disabled by default.
An unspecified vulnerability in Java SE related to the Networking component could allow a remote attacker to cause high integrity impact.
It was discovered that the C1 compiler in the Hotspot component of OpenJDK did not correctly apply an unsigned integer left shift to calculate the actual address offset under certain conditions. This could lead to an integer overflow and out-of-bounds array access, potentially corrupting the JVM memory.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
Oracle Critical Patch Update Advisory - January 2025: https://www.oracle.com/security-alerts/cpujan2025.html#AppendixJAVA
An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
A flaw was found in the way the FtpClient implementation in the Networking component of OpenJDK handled responses to the FTP PASV command. A malicious FTP server could cause a Java application using FtpClient to connect to a host and port that is not accessible from the FTP server and perform port scanning or banner extraction.
The fix for this issue prevents FtpClient from connecting to hosts different form the server used for the main FTP connection. As this fix may break certain FTP deployments, a newly introduced system property jdk.net.ftp.trustPasvAddress can be used to make FtpClient connect to any host specified in the PASV command response.
A flaw was found in the way the Hotspot component of OpenJDK performed range check elimination. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in the way the Library component of OpenJDK handled JAR files containing multiple MANIFEST.MF files. Such JAR files could cause signature verification process to return an incorrect result, possibly allowing tampering with signed JAR files. After the fix, all JAR files with multiple MANIFEST.MF files are treated as unsigned.
An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
Oracle Java SE 8u161 and 9.0.4 fixes an unspecified vulnerability in the Installer component (CVE-2018-2627). Upstream has CVSS scored this issue as: 7.5/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
External Reference:
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA
It was discovered that ICU Layout Engine was missing multiple boundary checks. These could lead to buffer overflows and JVM memory corruption. A specially crafted file could cause an application using ICU to parse untrusted font files to crash and, possibly, execute arbitrary code.
ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
An integer overflow flaw, leading to out-of-bounds read, was found in the LETableReference's verifyLength() method. A specially crafted file could cause an application using ICU to parse untrusted font files to perform an invalid memory access, leading to crash and possibly disclosure of portion of application memory.
ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
It was discovered that the Libraries component of OpenJDK failed to check current context / thread while performing object deserialization, possibly leading to incorrect input deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid.
This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection.
With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check.
It was discovered that the IIOPInputStream class in the CORBA component in OpenJDK failed to properly check object field types. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in the way the Libraries component of OpenJDK verified OCSP (Online Certificate Status Protocol) response. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity. This could allow a Java application to accept a revoked X.509 certificate as valid if it was presented with an OCSP response generated before certificate revocation.
It was discovered that the JCE (Java Cryptography Extension) component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring time used to perform operations using these non-constant time comparisons.
It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not prevent calls to the finalize() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
The patch prevents calls of the finalize() method. It also makes it possible to re-enable support for calling the method via the sun.rmi.server.invocationhandler.allowFinalizeInvocation system property.
It was discovered that the RMIConnectionImpl class in the JMX component of OpenJDK failed to properly check code permissions when creating repository class loaders. An untrusted Java application or applet could use this flaw to read information access to which should be restricted by the Java sandbox, partially bypassing sandbox restrictions.
It was discovered that the JMX component in OpenJDK failed to properly handle MBean connection proxy classes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
It was discovered that the DnsClient client class in the JNDI (Java Naming and Directory Interface) component in OpenJDK failed to properly remove information about an outgoing DNS request from the list of outstanding DNS requests when certain errors occurred during DNS resolution. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and possibly block further DNS resolution (after exhausting all DNS transaction ids).
It was discovered that the Elliptic Curve (EC) cryptography code as used in Mozilla NSS (Network Security Services) library and OpenJDK JCE (Java Cryptography Extension) component failed to properly validate EC parameters as used in ECDHDerive() function, which performs ECDH (Elliptic Curve Diffie-Hellman) key derivation. A remote attacker could use this flaw to disclose sensitive information.
The OpenJDK packages as shipped with Red Hat Enterprise Linux 5, 6 and 7 do not build the affected EC code and are therefore not directly affected. Future versions may provide EC support via NSS, see e.g. bug 1075702.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).