CVE-2018-11212

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java Advanced Management Console. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data. (CVE-2019-2540)

An issue was discovered in libjpeg 9a. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file. (CVE-2018-11212)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2019-2426)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version that is affected is Java SE: 8u192. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2019-2449)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2019-2422)

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Better FileChannel transfer performance (bsc#1122293)
• CVE-2019-2426: Improve web server connections
• CVE-2018-11212: Improve JPEG processing (bsc#1122299)
• Better route routing
• Better interface enumeration
• Better interface lists
• Improve BigDecimal support
• Improve robot support
• Better icon support
• Choose printer defaults
• Proper allocation handling
• Initial class initialization
• More reliable p11 transactions
• Improve NIO stability
• Better loading of classloader classes
• Strengthen Windows Access Bridge Support
• Improved data set handling
• Improved LSA authentication
• Libsunmscapi improved interactions

Non-security issues fix:

• Do not resolve by default the added JavaEE modules (bsc#1120431)
• ~2.5% regression on compression benchmark starting with 12-b11
• java.net.http.HttpClient hangs on 204 reply without Content-length 0
• Add additional TeliaSonera root certificate
• Add more ld preloading related info to hs_error file on Linux
• Add test to exercise server-side client hello processing
• AES encrypt performance regression in jdk11b11
• AIX: ProcessBuilder: Piping between created processes does not work.
• AIX: Some class library files are missing the Classpath exception
• AppCDS crashes for some uses with JRuby
• Automate vtable/itable stub size calculation
• BarrierSetC1::generate_referent_check() confuses register allocator
• Better HTTP Redirection
• Catastrophic size_t underflow in BitMap::*_large methods
• Clip.isRunning() may return true after Clip.stop() was called
• Compiler thread creation should be bounded by available space in memory and Code Cache
• com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code
• Default mask register for avx512 instructions
• Delayed starting of debugging via jcmd
• Disable all DES cipher suites
• Disable anon and NULL cipher suites
• Disable unsupported GCs for Zero
• Epsilon alignment adjustments can overflow max TLAB size
• Epsilon elastic TLAB sizing may cause misalignment
• HotSpot update for vm_version.cpp to recognise updated VS2017
• HttpClient does not retrieve files with large sizes over HTTP/1.1
• IIOException 'tEXt chunk length is not proper' on opening png file
• Improve TLS connection stability again
• InitialDirContext ctor sometimes throws NPE if the server has sent a disconnection
• Inspect stack during error reporting
• Instead of circle rendered in appl window, but ellipse is produced JEditor Pane
• Introduce diagnostic flag to abort VM on failed JIT compilation
• Invalid assert(HeapBaseMinAddress > 0) in ReservedHeapSpace::initialize_compressed_heap
• jar has issues with UNC-path arguments for the jar -C parameter [windows]
• java.net.http HTTP client should allow specifying Origin and Referer headers
• java.nio.file.Files.writeString writes garbled UTF-16 instead of UTF-8
• JDK 11.0.1 l10n resource file update
• JDWP Transport Listener: dt_socket thread crash
• JVMTI ResourceExhausted should not be posted in CompilerThread
• LDAPS communication failure with jdk 1.8.0_181
• linux: Poor StrictMath performance due to non-optimized compilation
• Missing synchronization when reading counters for live threads and peak thread count
• NPE in SupportedGroupsExtension
• OpenDataException thrown when constructing CompositeData for StackTraceElement
• Parent class loader may not have a referred ClassLoaderData instance when obtained in Klass::class_in_module_of_loader
• Populate handlers while holding streamHandlerLock
• ppc64: Enable POWER9 CPU detection
• print_location is not reliable enough (printing register info)
• Reconsider default option for ClassPathURLCheck change done in JDK-8195874
• Register to register spill may use AVX 512 move instruction on unsupported platform.
• s390: Use of shift operators not covered by cpp standard
• serviceability/sa/TestUniverse.java#id0 intermittently…

This update for java-1_8_0-openjdk to version jdk8u201 (icedtea 3.11.0) fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).

Complete list of changes: https://mail.openjdk.java.net/pipermail/distro-pkg-dev/2019-March/041223.html

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-15-openjdk-15.0.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openjdk to version 11.0.2+7 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Better FileChannel transfer performance (bsc#1122293)
• CVE-2019-2426: Improve web server connections
• CVE-2018-11212: Improve JPEG processing (bsc#1122299)
• Better route routing
• Better interface enumeration
• Better interface lists
• Improve BigDecimal support
• Improve robot support
• Better icon support
• Choose printer defaults
• Proper allocation handling
• Initial class initialization
• More reliable p11 transactions
• Improve NIO stability
• Better loading of classloader classes
• Strengthen Windows Access Bridge Support
• Improved data set handling
• Improved LSA authentication
• Libsunmscapi improved interactions

Non-security issues fix:

• Do not resolve by default the added JavaEE modules (bsc#1120431)
• ~2.5% regression on compression benchmark starting with 12-b11
• java.net.http.HttpClient hangs on 204 reply without Content-length 0
• Add additional TeliaSonera root certificate
• Add more ld preloading related info to hs_error file on Linux
• Add test to exercise server-side client hello processing
• AES encrypt performance regression in jdk11b11
• AIX: ProcessBuilder: Piping between created processes does not work.
• AIX: Some class library files are missing the Classpath exception
• AppCDS crashes for some uses with JRuby
• Automate vtable/itable stub size calculation
• BarrierSetC1::generate_referent_check() confuses register allocator
• Better HTTP Redirection
• Catastrophic size_t underflow in BitMap::*_large methods
• Clip.isRunning() may return true after Clip.stop() was called
• Compiler thread creation should be bounded by available space in memory and Code Cache
• com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code
• Default mask register for avx512 instructions
• Delayed starting of debugging via jcmd
• Disable all DES cipher suites
• Disable anon and NULL cipher suites
• Disable unsupported GCs for Zero
• Epsilon alignment adjustments can overflow max TLAB size
• Epsilon elastic TLAB sizing may cause misalignment
• HotSpot update for vm_version.cpp to recognise updated VS2017
• HttpClient does not retrieve files with large sizes over HTTP/1.1
• IIOException 'tEXt chunk length is not proper' on opening png file
• Improve TLS connection stability again
• InitialDirContext ctor sometimes throws NPE if the server has sent a disconnection
• Inspect stack during error reporting
• Instead of circle rendered in appl window, but ellipse is produced JEditor Pane
• Introduce diagnostic flag to abort VM on failed JIT compilation
• Invalid assert(HeapBaseMinAddress > 0) in ReservedHeapSpace::initialize_compressed_heap
• jar has issues with UNC-path arguments for the jar -C parameter [windows]
• java.net.http HTTP client should allow specifying Origin and Referer headers
• java.nio.file.Files.writeString writes garbled UTF-16 instead of UTF-8
• JDK 11.0.1 l10n resource file update
• JDWP Transport Listener: dt_socket thread crash
• JVMTI ResourceExhausted should not be posted in CompilerThread
• LDAPS communication failure with jdk 1.8.0_181
• linux: Poor StrictMath performance due to non-optimized compilation
• Missing synchronization when reading counters for live threads and peak thread count
• NPE in SupportedGroupsExtension
• OpenDataException thrown when constructing CompositeData for StackTraceElement
• Parent class loader may not have a referred ClassLoaderData instance when obtained in Klass::class_in_module_of_loader
• Populate handlers while holding streamHandlerLock
• ppc64: Enable POWER9 CPU detection
• print_location is not reliable enough (printing register info)
• Reconsider default option for ClassPathURLCheck change done in JDK-8195874
• Register to register spill may use AVX 512 move instruction on unsupported platform.
• s390: Use of shift operators not covered by cpp standard
• serviceability/sa/TestUniverse.java#id0 intermittently…

This update for java-1_8_0-openjdk to version jdk8u201 (icedtea 3.11.0) fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).

Complete list of changes: https://mail.openjdk.java.net/pipermail/distro-pkg-dev/2019-March/041223.html

This update for java-1_8_0-ibm to version 8.0.5.30 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).
• CVE-2018-1890: Fixed a local privilege escalation via RPATHs (bsc#1128158).
• CVE-2019-2449: Fixed a vulnerabilit which could allow remote atackers to delete arbitrary files (bsc#1122292).

More information: https://www-01.ibm.com/support/docview.wss?uid=ibm10873332

This update for java-1_7_1-ibm to version 7.1.4.40 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).

More information: https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_February_2019

This update for java-1_8_0-ibm to version 8.0.5.30 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).
• CVE-2018-1890: Fixed a local privilege escalation via RPATHs (bsc#1128158).
• CVE-2019-2449: Fixed a vulnerabilit which could allow remote atackers to delete arbitrary files (bsc#1122292).

More information: https://www-01.ibm.com/support/docview.wss?uid=ibm10873332

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2019-2422: Better FileChannel (bsc#1122293).
• CVE-2018-11212: Improve JPEG (bsc#1122299).

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_7_0-openjdk fixes the following issues:

Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU)

Security issues fixed:

• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw inside the RMI registry implementation (bsc#1132732).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2422: Fixed memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray function in jmemmgr.c (bsc#1122299).
• CVE-2019-2426: Improve web server connections (bsc#1134297).

Bug fixes:

• Please check the package Changelog for detailed information.

This update for java-1_7_0-ibm to version 7.0.10.40 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).

More information: https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_February_2019

This update for java-1_7_1-ibm to version 7.1.4.40 fixes the following issues:

Security issues fixed:

• CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299).

More information: https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_February_2019

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

• CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
• CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
• CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
• CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
• CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
• CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

• CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
• CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
• CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
• CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
• CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
• CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary code.

Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2016-3616)

It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152, CVE-2020-14153)

It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2018-11213, CVE-2018-11214)

It was discovered that Libjpeg6b was not properly performing bounds checks when compressing PPM and Targa image files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-11212)

Chijin Zhou discovered that Libjpeg6b was incorrectly handling the EOF character in input data when generating JPEG files. An attacker could possibly use this issue to force the execution of a large loop, force excessive memory consumption, and cause a denial of service. (CVE-2018-11813)

Sheng Shu and Dongdong She discovered that Libjpeg6b was not properly limiting the amount of memory being used when it was performing decompression or multi-pass compression operations. An attacker could possibly use this issue to force excessive memory consumption and cause a denial of service. (CVE-2020-14152)

USN-5497-1 fixed vulnerabilities in Libjpeg6b. This update provides the corresponding updates for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Libjpeg6b was not properly performing bounds checks when compressing PPM and Targa image files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-11212)

Chijin Zhou discovered that Libjpeg6b was incorrectly handling the EOF character in input data when generating JPEG files. An attacker could possibly use this issue to force the execution of a large loop, force excessive memory consumption, and cause a denial of service. (CVE-2018-11813)

Sheng Shu and Dongdong She discovered that Libjpeg6b was not properly limiting the amount of memory being used when it was performing decompression or multi-pass compression operations. An attacker could possibly use this issue to force excessive memory consumption and cause a denial of service. (CVE-2020-14152)