SUSE-SU-2018:3064-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2018/suse-su-20183064-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:3064-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2018:3064-1

Related

CVE-2018-2938
CVE-2018-2940
CVE-2018-2952
CVE-2018-2973
CVE-2018-3639

Published

2018-10-08T05:42:59Z

Modified

2018-10-08T05:42:59Z

Summary

Security update for java-1_8_0-openjdk

Details

This update for java-180-openjdk to the jdk8u181 (icedtea 3.9.0) release fixes the following issues:

These security issues were fixed:

CVE-2018-2938: Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE (bsc#1101644).
CVE-2018-2940: Vulnerability in subcomponent: Libraries. Easily exploitable vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data (bsc#1101645)
CVE-2018-2952: Vulnerability in subcomponent: Concurrency. Difficult to exploit vulnerability allowed unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit (bsc#1101651)
CVE-2018-2973: Vulnerability in subcomponent: JSSE. Difficult to exploit vulnerability allowed unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data (bsc#1101656)

These non-security issues were fixed:

Improve desktop file usage
Better Internet address support
speculative traps break when classes are redefined
sun/security/pkcs11/ec/ReadCertificates.java fails intermittently
Clean up code that saves the previous versions of redefined classes
Prevent SIGSEGV in ReceiverTypeData::cleanweakklass_links
RedefineClasses() tests fail assert(((Metadata*)obj)->is_valid()) failed: obj is valid
NMT is not enabled if NMT option is specified after class path specifiers
EndEntityChecker should not process custom extensions after PKIX validation
SupportedDSAParamGen.java failed with timeout
Montgomery multiply intrinsic should use correct name
When determining the ciphersuite lists, there is no debug output for disabled suites.
sun/security/mscapi/SignedObjectChain.java fails on Windows
On Windows Swing changes keyboard layout on a window activation
IfNode::rangechecktrap_proj() should handler dying subgraph with single if proj
Even better Internet address support
Newlines in JAXB string values of SOAP-requests are escaped to ' '
TestFlushableGZIPOutputStream failing with IndexOutOfBoundsException
Unable to use JDWP API in JDK 8 to debug JDK 9 VM
Hotspot crash on Cassandra 3.11.1 startup with libnuma 2.0.3
Performance drop with Java JDK 1.8.0_162-b32
Upgrade time-zone data to tzdata2018d
Fix potential crash in BufImg_SetupICM
JDK 8u181 l10n resource file update
Remove debug print statements from RMI fix
(tz) Upgrade time-zone data to tzdata2018e
ObjectInputStream filterCheck method throws NullPointerException
adjust reflective access checks

References

Affected packages

SUSE:OpenStack Cloud 7 / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Linux Enterprise Desktop 12 SP3 / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2-LTSS / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP3 / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP3 / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}

SUSE:Enterprise Storage 4 / java-1_8_0-openjdk

Package

Name: java-1_8_0-openjdk
Purl: purl:rpm/suse/java-1_8_0-openjdk&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0.181-27.26.2

Ecosystem specific

{
    "binaries": [
        {
            "java-1_8_0-openjdk-demo": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-devel": "1.8.0.181-27.26.2",
            "java-1_8_0-openjdk-headless": "1.8.0.181-27.26.2"
        }
    ]
}