Ubuntu alert USN-7097-1 (openjdk-lts)
| From: | Evan Caville <evan.caville@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-7097-1] OpenJDK 11 vulnerabilities | |
| Date: | Mon, 11 Nov 2024 15:10:25 +1000 | |
| Message-ID: | <96b6a197-8bc9-4c4c-b9c7-0e6373418297@canonical.com> |
========================================================================== Ubuntu Security Notice USN-7097-1 November 11, 2024 openjdk-lts vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in OpenJDK 11. Software Description: - openjdk-lts: Open Source Java implementation Details: Andy Boothe discovered that the Networking component of OpenJDK 11 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208) It was discovered that the Hotspot component of OpenJDK 11 did not properly handle vectorization under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose sensitive information. (CVE-2024-21210, CVE-2024-21235) It was discovered that the Serialization component of OpenJDK 11 did not properly handle deserialization under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21217) It was discovered that the Hotspot component of OpenJDK 11 was not properly bounding certain UTF-8 strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21131) It was discovered that the Hotspot component of OpenJDK 11 could be made to run into an infinite loop. If an automated system were tricked into processing excessively large symbols, an attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21138) It was discovered that the Hotspot component of OpenJDK 11 did not properly perform range check elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21140) Yakov Shafranovich discovered that the Concurrency component of OpenJDK 11 incorrectly performed header validation in the Pack200 archive format. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21144) Sergey Bylokhov discovered that OpenJDK 11 did not properly manage memory when handling 2D images. An attacker could possibly use this issue to obtain sensitive information. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21145) It was discovered that the Hotspot component of OpenJDK 11 incorrectly handled memory when performing range check elimination under certain circumstances. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21147) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 openjdk-11-jdk 11.0.25+9-1ubuntu1~24.10 openjdk-11-jdk-headless 11.0.25+9-1ubuntu1~24.10 openjdk-11-jre 11.0.25+9-1ubuntu1~24.10 openjdk-11-jre-headless 11.0.25+9-1ubuntu1~24.10 openjdk-11-jre-zero 11.0.25+9-1ubuntu1~24.10 Ubuntu 24.04 LTS openjdk-11-jdk 11.0.25+9-1ubuntu1~24.04 openjdk-11-jdk-headless 11.0.25+9-1ubuntu1~24.04 openjdk-11-jre 11.0.25+9-1ubuntu1~24.04 openjdk-11-jre-headless 11.0.25+9-1ubuntu1~24.04 openjdk-11-jre-zero 11.0.25+9-1ubuntu1~24.04 Ubuntu 22.04 LTS openjdk-11-jdk 11.0.25+9-1ubuntu1~22.04 openjdk-11-jdk-headless 11.0.25+9-1ubuntu1~22.04 openjdk-11-jre 11.0.25+9-1ubuntu1~22.04 openjdk-11-jre-headless 11.0.25+9-1ubuntu1~22.04 openjdk-11-jre-zero 11.0.25+9-1ubuntu1~22.04 Ubuntu 20.04 LTS openjdk-11-jdk 11.0.25+9-1ubuntu1~20.04 openjdk-11-jdk-headless 11.0.25+9-1ubuntu1~20.04 openjdk-11-jre 11.0.25+9-1ubuntu1~20.04 openjdk-11-jre-headless 11.0.25+9-1ubuntu1~20.04 openjdk-11-jre-zero 11.0.25+9-1ubuntu1~20.04 Ubuntu 18.04 LTS openjdk-11-jdk 11.0.25+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jdk-headless 11.0.25+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre 11.0.25+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre-headless 11.0.25+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre-zero 11.0.25+9-1ubuntu1~18.04 Available with Ubuntu Pro This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7097-1 CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147, CVE-2024-21208, CVE-2024-21210, CVE-2024-21217, CVE-2024-21235 Package Information: https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.25+... https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.25+... https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.25+... https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.25+...
Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmcxkcEFAwAAAAAACgkQWNrRIKaTkWfZ KQ//VbZ0IkJl0Ukw6a02E52Z6WVyvQe3JUCP6z1AaoLp3hQ78KlX/JBAyTZh7VnspfV4FlNuzL9r AwBg5vFo13TV2HnOYCN2ZWMb0OS2ZvvBbA5XYbn+W82u0PPYlaVdGiOSVxBZnkrq0rzwm06fYbNL 3cObG63R9A8spvC1WjvtOTLSDG4GDPTgvpAd4Xa7ZJujkMj8oopd2rXLhKTDuPYpLzne+Tk44LxC 2FZu/0GstRnNahRM2SlEuty5W6+xeXlQgmqzKqBUW9FIg1CgWb1abCSW+e0veOg0yUIU3szSFMba aFxI1wqYUQIeUK3eXZEXBmU/2DWDgHRBRZsyFy1KO4cRB4xTMp3MrCnQfLP1BBfrdPCHGtmBtH/g RRbsFR1WQbx03PBcKeDjYnctJ1VIp3ND7LvEtTtJytta+0bBrk+m9AZ00rCIzy43Cqj0gRSxtfA0 5VS7cQ0mkfJ+XOi/FgFNAS4JUcxluJY+cuTzUycuOGNqZGbl6Qj4ilEjb+Lmw12RTYxHQoeVI9IG AoaKi6AcbJiOsxlhxMRHkG2+wCJcpvpXKnuG5jLW9wNp5+eNWlHDu9V+DaUFgHjx7hSnpQGGRKvP 1TkzmuExsxbvjzA/ZpWgxqibhe0f4+wHuNfcaZSy8IJjzmd1IaiB/qA3eU49CPXi4neFW48Od7yS KeE= =r4W7 -----END PGP SIGNATURE-----
Attachment: None (type=text/plain)