CVE-2019-2684

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.

The updated packages fix several bugs and some security issues:

Font layout engine out of bounds access setCurrGlyphID(). (CVE-2019-2698)

Slow conversion of BigDecimal to long. (CVE-2019-2602)

Incorrect skeleton selection in RMI registry server-side dispatch handling. (CVE-2019-2684)

This update for java-11-openjdk to version 11.0.3+7 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Fixed excessive use of CPU time in the BigDecimal implementation (bsc#1132728).
• CVE-2019-2684: Fixed a flaw in the RMI registry implementation which could lead to selection of an incorrect skeleton class (bsc#1132732).

Non-security issues fixed:

• Multiple bug fixes and improvements.

This update was imported from the SUSE:SLE-15:Update update project.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-15-openjdk-15.0.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openjdk to version 11.0.3+7 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Fixed excessive use of CPU time in the BigDecimal implementation (bsc#1132728).
• CVE-2019-2684: Fixed a flaw in the RMI registry implementation which could lead to selection of an incorrect skeleton class (bsc#1132732).

Non-security issues fixed:

• Multiple bug fixes and improvements.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2019-2422: Better FileChannel (bsc#1122293).
• CVE-2018-11212: Improve JPEG (bsc#1122299).

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 45.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_7_0-openjdk fixes the following issues:

Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU)

Security issues fixed:

• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw inside the RMI registry implementation (bsc#1132732).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2422: Fixed memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray function in jmemmgr.c (bsc#1122299).
• CVE-2019-2426: Improve web server connections (bsc#1134297).

Bug fixes:

• Please check the package Changelog for detailed information.

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 45.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

It was discovered that the BigDecimal implementation in OpenJDK performed excessive computation when given certain values. An attacker could use this to cause a denial of service (excessive CPU usage). (CVE-2019-2602)

Corwin de Boor and Robert Xiao discovered that the RMI registry implementation in OpenJDK did not properly select the correct skeleton class in some situations. An attacker could use this to possibly escape Java sandbox restrictions. (CVE-2019-2684)

Mateusz Jurczyk discovered a vulnerability in the 2D component of OpenJDK. An attacker could use this to possibly escape Java sandbox restrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04 LTS. (CVE-2019-2697)

Mateusz Jurczyk discovered a vulnerability in the font layout engine of OpenJDK's 2D component. An attacker could use this to possibly escape Java sandbox restrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04 LTS. (CVE-2019-2698)