CVE-2019-2786

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).

The updated packages fix several bugs and some security issues:

Side-channel attack risks in Elliptic Curve (EC) cryptography. (CVE-2019-2745)

Insufficient checks of suppressed exceptions in deserialization. (CVE-2019-2762)

Unbounded memory allocation during deserialization in Collections. (CVE-2019-2769)

Insufficient restriction of privileges in AccessController. (CVE-2019-2786)

Missing URL format validation. (CVE-2019-2816)

Missing array bounds check in crypto providers. (CVE-2019-2842)

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues:

Security issues fixed:

• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2842: Extended AES support (bsc#1141786).
• CVE-2019-7317: Improve PNG support (bsc#1141780).
• Certificate validation improvements

Non-security issue fixed:

• Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

This update was imported from the SUSE:SLE-15:Update update project.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues:

Security issues fixed:

• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-7317: Improve PNG support options (bsc#1141780).
• CVE-2019-2818: Better Poly1305 support (bsc#1141788).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2821: Improve TLS negotiation (bsc#1141781).
• Certificate validation improvements

Non-security issues fixed:

• Do not fail installation when the manpages are not present (bsc#1115375)
• Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues:

Security issues fixed:

• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-7317: Improve PNG support options (bsc#1141780).
• CVE-2019-2818: Better Poly1305 support (bsc#1141788).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2821: Improve TLS negotiation (bsc#1141781).
• Certificate validation improvements

Non-security issues fixed:

• Do not fail installation when the manpages are not present (bsc#1115375)
• Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461)

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues:

Security issues fixed:

• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2842: Extended AES support (bsc#1141786).
• CVE-2019-7317: Improve PNG support (bsc#1141780).
• Certificate validation improvements

Non-security issue fixed:

• Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

This update for java-1_7_0-openjdk to version 7u231 fixes the following issues:

Security issues fixed:

• CVE_2019-2426: Improve web server connections (bsc#1134297).
• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2842: Extended AES support (bsc#1141786).
• CVE-2019-7317: Improve PNG support (bsc#1141780).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE (bsc#1087082).
• Certificate validation improvements

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues:

Security issues fixed:

• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2842: Extended AES support (bsc#1141786).
• CVE-2019-7317: Improve PNG support (bsc#1141780).
• Certificate validation improvements

Non-security issue fixed:

• Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues:

Security issues fixed:

• CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
• CVE-2019-2762: Exceptional throw cases (bsc#1141782).
• CVE-2019-2766: Improve file protocol handling (bsc#1141789).
• CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
• CVE-2019-2786: More limited privilege usage (bsc#1141787).
• CVE-2019-2816: Normalize normalization (bsc#1141785).
• CVE-2019-2842: Extended AES support (bsc#1141786).
• CVE-2019-7317: Improve PNG support (bsc#1141780).
• Certificate validation improvements

Non-security issue fixed:

• Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

• CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
• CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
• CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
• CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
• CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
• CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

• CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
• CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
• CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
• CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
• CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
• CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
• CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

Keegan Ryan discovered that the ECC implementation in OpenJDK was not sufficiently resilient to side-channel attacks. An attacker could possibly use this to expose sensitive information. (CVE-2019-2745)

It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing suppressed exceptions in some situations. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of service. (CVE-2019-2762)

It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated during object deserialization. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of service (excessive memory consumption). (CVE-2019-2769)

It was discovered that OpenJDK did not properly restrict privileges in certain situations. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2019-2786)

Jonathan Birch discovered that the Networking component of OpenJDK did not properly validate URLs in some situations. An attacker could use this to bypass restrictions on characters in URLs. (CVE-2019-2816)

Nati Nimni discovered that the Java Cryptography Extension component in OpenJDK did not properly perform array bounds checking in some situations. An attacker could use this to cause a denial of service. (CVE-2019-2842)

It was discovered that OpenJDK incorrectly handled certain memory operations. If a user or automated system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to cause OpenJDK to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-7317)

It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing suppressed exceptions in some situations. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of service. (CVE-2019-2762)

It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated during object deserialization. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of service (excessive memory consumption). (CVE-2019-2769)

It was discovered that OpenJDK did not properly restrict privileges in certain situations. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. (CVE-2019-2786)

Jonathan Birch discovered that the Networking component of OpenJDK did not properly validate URLs in some situations. An attacker could use this to bypass restrictions on characters in URLs. (CVE-2019-2816)

It was discovered that the ChaCha20Cipher implementation in OpenJDK did not use constant time computations in some situations. An attacker could use this to expose sensitive information. (CVE-2019-2818)

It was discovered that the Java Secure Socket Extension (JSSE) component in OpenJDK did not properly handle OCSP stapling messages during TLS handshake in some situations. An attacker could use this to expose sensitive information. (CVE-2019-2821)

It was discovered that OpenJDK incorrectly handled certain memory operations. If a user or automated system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to cause OpenJDK to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-7317)