It was discovered that the ObjectIdentifier class in the Libraries component of OpenJDK did not properly validate the encoded length of the object identifier. This could lead to an integer underflow and possibly cause a Java application to throw an out of memory (OOM) exception because of excessive memory allocation.

A flaw was found in the way the BMPImageReader class implementation in the ImageIO component of OpenJDK handled memory allocations when processing uncompressed BMP images. A specially-crafted BMP image with a small size could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition.

A flaw was found in the way the BMPImageReader class implementation in the ImageIO component of OpenJDK handled memory allocations when processing uncompressed BMP images. A specially-crafted BMP image with a small size could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition.

A flaw was found in the SSL logger implementation in the JSSE component of OpenJDK. A malicious client could cause a Java application acting as TLS server to raise an unexpected exception during TLS handshake.

An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.

It was discovered that the Kerberos protocol implementation in the Libraries component of OpenJDK did not correctly report subject principals when using Kerberos Constrained Delegation. This could lead to the use of wrong Kerberos tickets.

A flaw was found in the way the Keytool component of OpenJDK handled X.509 certificates with validity period ending too far in the future, after year 9999. When such certificates were imported into a keystore, they could cause corruption of the keystore.

A flaw was found in the way the RTFReader class implementation in the Swing component of OpenJDK handled style keyword parameters. A specially crafted Rich Text Format (RTF) file could cause a Java application using RTFReader to allocate an excessive ammount of memory and possibly terminate on out-of-memory condition.

An inifinte loop flaw was found in the HttpsServer class implementation in the JSSE component of OpenJDK. A remote attacker could possibly use this flaw to cause a Java application implementing HTTPS server functionality to loop during the TLS session closing and consume an excessive amount of CPU time.

A flaw was found in the way the RTFParser class implementation in the Swing component of OpenJDK handled memory allocations. A specially crafted Rich Text Format (RTF) file could cause a Java application using RTFParser to allocate an excessive amount of memory and possibly terminate on out-of-memory condition.

A CRLF injection flaw was found in the Lightweight HTTP Server component of OpenJDK. The HttpServer implementation did not restrict the use of CR and LF characters in values for HTTP headers, possibly allowing HTTP response splitting attacks.

A regular expression denial of service flaw was found in the Concurrency component of OpenJDK. The use of overly complex regular expressions in java.utils.Scanner could cause a high CPU usage when Scanner was used on parse certain inputs.

A flaw was found in the way the HashMap and the HashSet classes implementations in the Utility component of OpenJDK validated the load factor value during deserialization. A specially crafted serialized data stream could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition when deserialized.

A flaw was found in the way the HashMap and the HashSet classes implementations in the Utility component of OpenJDK validated the load factor value during deserialization. A specially crafted serialized data stream could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition when deserialized.

An unspecified vulnerability in Java SE related to the Hotspot component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.

An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.

A flaw was found in the way the TLS implementation in the JSSE component of OpenJDK re-used single null TLS sessions for new TLS connections. A remote attacker could possibly use this flaw to impact availability of a Java application providing TLS server.

It was discovered that the implementation of the Throwable class in the Utilities component of OpenJDK did not sufficiently validate serial stream before deserializing suppressed exceptions. A specially-crafted input could cause a Java application to construct inconsistent object and possibly use an excessive amount of system resources when deserialized.

It was discovered that the implementation of the Collections class in the Utilities component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.

A certificate verification flaw was found in the JSSE component of OpenJDK. No check was preformed during the TLS session resumption to ensure that the same endpoint identification algorithm had been used when originally opening the session as was required when resuming the session. In certain cases, this could lead to having TLS connection established without required server identity verification.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.

It was discovered that the XMLEntityManager class implementation in the JAXP component of OpenJDK did not properly perform access checks. A Java application using SAX XML parser in certain configuration could be tricked into disclosing information when parsing a specially-crafted XML file.

A flaw was found in the way the XMLEntityScanner and XML11EntityScanner classes in the JAXP component of OpenJDK handled and normalized newlines in XML entities. A specially-crafted XML document could cause a Java application to enter an infinite loop when parsed.

GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.

It was discovered that the Kerberos implementation in the Security component of OpenJDK used RSA-MD5 checksum in Ticket Granting Service (TGS) requests even though MD5 algorithm is no longer considered safe for such use case. A remote attacker could possibly use this flaw to manipulate TGS requests.

A flaw was found in the URL class implementation in the Networking component of OpenJDK. An incorrect check to determine if a URLStreamHandler is builtin or not can lead to incorrect URL normalization in certain cases.

Jakub Wilk reported in a Debian bug report [1] that the unpack200 program included in OpenJDK did not properly handle the logfile properly. If the the log file was unable to be opened, it would create /tmp/unpack.log instead as the fallback, but do so in an insecure manner, as shown in unpack.cpp (the below is from OpenJDK 6):

4732 void unpacker::redirectstdio() { ... 4757 #else 4758 sprintf(tmpdir,"/tmp"); 4759 sprintf(logfilename, "/tmp/unpack.log"); 4760 #endif 4761 if ((errstrm = fopen(logfilename, "a+")) != NULL) { 4762 logfile = errstrmname = saveStr(logfilename); 4763 return ; 4764 } 4765 4766 char tname = tempnam(tmpdir,"#upkg"); 4767 sprintf(logfilename, "%s", tname); 4768 if ((errstrm = fopen(logfilename, "a+")) != NULL) { 4769 logfile = errstrmname = saveStr(logfilename); 4770 return ; 4771 }

The same exists in OpenJDK 7 and 8.

This could allow a malicious local attacker to conduct local attacks, such as symlink attacks, where a file could be overwritten if the user running unpack200 had write permissions.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562

Chris Evans discovered a memory leak flaw in LittleCms. This flaw could cause applications that use the system LittleCms library, or embed the source into their application, to crash.

Acknowledgements:

Red Hat would like to thank Chris Evans from the Google Security Team for reporting this issue.

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

A flaw was found in the way the Attributes class in the Libraries component of OpenJDK performed reading of attributes with very long values from JAR file manifests. A specially-crafted JAR archive could cause a Java application reading its manifest to use excessive amount of system resources and hang.