CVE-2020-14792

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

• Bump to 2.6.28 and OpenJDK 7u351-b01.
• Security fixes in 7u351:
• CVE-2022-21540: Improve class compilation (JDK-8281859)
• CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
• CVE-2022-34169: Improve Xalan supports (JDK-8285407)
• Security fixes in 7u341:
• CVE-2022-21426: Better XPath expression handling (JDK-8270504)
• CVE-2022-21434: Better invocation handler handling (JDK-8277672)
• CVE-2022-21443: Improved Object Identification (JDK-8275151)
• CVE-2022-21476: Improve Santuario processing (JDK-8278008)
• CVE-2022-21496: Improve URL supports (JDK-8278972)
• Security fixes in 7u331:
• CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
• CVE-2022-21282: Better resolution of URIs (JDK-8270492)
• CVE-2022-21283: Better String matching (JDK-8268813)
• CVE-2022-21293: Improve String constructions (JDK-8270392)
• CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
• CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
• CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
• CVE-2022-21305: Better array indexing (JDK-8272014)
• CVE-2022-21340: Verify Jar Verification (JDK-8272026)
• CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
• CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
• CVE-2022-21360: Enhance BMP image support (JDK-8273756)
• CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
• Security fixes in 7u321:
• CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
• CVE-2021-35556: Richer Text Editors (JDK-8265167)
• CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
• CVE-2021-35561: Better hashing support (JDK-8266097)
• CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
• CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
• CVE-2021-35586: Better BMP support (JDK-8267735)
• CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
• CVE-2021-35603: Better session identification (JDK-8269618)
• Security fixes in 7u311:
• CVE-2021-2341: Improve file transfers (JDK-8258432)
• CVE-2021-2369: Better jar file validation (JDK-8260967)
• CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
• Security fixes in 7u301:
• CVE-2021-2161: Less ambiguous processing (JDK-8250568)
• CVE-2021-2163: Enhance opening JARs (JDK-8249906)
• Security fixes in 7u281:
• CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
• CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
• CVE-2020-14782: Enhance certificate processing (JDK-8237995)
• CVE-2020-14792: Better range handling (JDK-8241114)
• CVE-2020-14796: Improved URI Support (JDK-8242680)
• CVE-2020-14797: Better Path Validation (JDK-8242685)
• CVE-2020-14798: Enhanced buffer support (JDK-8242695)
• CVE-2020-14803: Improved Buffer supports (JDK-8244136)
• Security fixes in 7u271:
• CVE-2020-14577: Enhance certificate verification (JDK-8237592)
• CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
• CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
• CVE-2020-14581: Better matrix operations (JDK-8238002)
• CVE-2020-14583: Better Buffer support (JDK-8238920)
• CVE-2020-14593: Less Affine Transformations (JDK-8240119)
• CVE-2020-14621: Better XML namespace handling (JDK-8242136)
• Update tzdata requirement to 2022a to match JDK-8283350
• Update NEWS from IcedTea
• Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version

• Bump to 2.6.28 and OpenJDK 7u351-b01.
• Security fixes in 7u351:
• CVE-2022-21540: Improve class compilation (JDK-8281859)
• CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
• CVE-2022-34169: Improve Xalan supports (JDK-8285407)
• Security fixes in 7u341:
• CVE-2022-21426: Better XPath expression handling (JDK-8270504)
• CVE-2022-21434: Better invocation handler handling (JDK-8277672)
• CVE-2022-21443: Improved Object Identification (JDK-8275151)
• CVE-2022-21476: Improve Santuario processing (JDK-8278008)
• CVE-2022-21496: Improve URL supports (JDK-8278972)
• Security fixes in 7u331:
• CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
• CVE-2022-21282: Better resolution of URIs (JDK-8270492)
• CVE-2022-21283: Better String matching (JDK-8268813)
• CVE-2022-21293: Improve String constructions (JDK-8270392)
• CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
• CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
• CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
• CVE-2022-21305: Better array indexing (JDK-8272014)
• CVE-2022-21340: Verify Jar Verification (JDK-8272026)
• CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
• CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
• CVE-2022-21360: Enhance BMP image support (JDK-8273756)
• CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
• Security fixes in 7u321:
• CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
• CVE-2021-35556: Richer Text Editors (JDK-8265167)
• CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
• CVE-2021-35561: Better hashing support (JDK-8266097)
• CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
• CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
• CVE-2021-35586: Better BMP support (JDK-8267735)
• CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
• CVE-2021-35603: Better session identification (JDK-8269618)
• Security fixes in 7u311:
• CVE-2021-2341: Improve file transfers (JDK-8258432)
• CVE-2021-2369: Better jar file validation (JDK-8260967)
• CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
• Security fixes in 7u301:
• CVE-2021-2161: Less ambiguous processing (JDK-8250568)
• CVE-2021-2163: Enhance opening JARs (JDK-8249906)
• Security fixes in 7u281:
• CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
• CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
• CVE-2020-14782: Enhance certificate processing (JDK-8237995)
• CVE-2020-14792: Better range handling (JDK-8241114)
• CVE-2020-14796: Improved URI Support (JDK-8242680)
• CVE-2020-14797: Better Path Validation (JDK-8242685)
• CVE-2020-14798: Enhanced buffer support (JDK-8242695)
• CVE-2020-14803: Improved Buffer supports (JDK-8244136)
• Security fixes in 7u271:
• CVE-2020-14577: Enhance certificate verification (JDK-8237592)
• CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
• CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
• CVE-2020-14581: Better matrix operations (JDK-8238002)
• CVE-2020-14583: Better Buffer support (JDK-8238920)
• CVE-2020-14593: Less Affine Transformations (JDK-8240119)
• CVE-2020-14621: Better XML namespace handling (JDK-8242136)
• Update tzdata requirement to 2022a to match JDK-8283350
• Update NEWS from IcedTea
• Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version

High memory usage during deserialization of Proxy class with many interfaces. (CVE-2020-14779)

Credentials sent over unencrypted LDAP connection. (CVE-2020-14781)

Certificate blacklist bypass via alternate certificate encodings. (CVE-2020-14782)

Integer overflow leading to out-of-bounds access. (CVE-2020-14792)

Missing permission check in path to URI conversion. (CVE-2020-14796)

Incomplete check for invalid characters in URI to path conversion. (CVE-2020-14797)

Race condition in NIO Buffer boundary checks. (CVE-2020-14803)

Also, the timezone package has been updated to version 2020d.

This update for java-1_8_0-openj9 fixes the following issues:

-OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 (bsc#1174157) and October 2020 CPU (bsc#1177943)

• CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581, CVE-2020-14583, CVE-2020-14593, CVE-2020-14621, CVE-2020-14779, CVE-2020-14781, CVE-2020-14782, CVE-2020-14792, CVE-2020-14796, CVE-2020-14797, CVE-2020-14798 and CVE-2020-14803

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

These are all security issues fixed in the java-11-openj9-11.0.11.0-3.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-15-openjdk-15.0.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-1_7_0-ibm fixes the following issues:

• Update to Java 7.0 Service Refresh 10 Fix Pack 75 [bsc#1180063, bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  • Class Libraries:
    • Z/OS specific C function send_file is changing the file pointer position
  • Security:
    • Add the new oracle signer certificate
    • Certificate parsing error
    • JVM memory growth can be caused by the IBMPKCS11IMPL crypto provider
    • Remove check for websphere signed jars
    • sessionid.hashcode generates too many collisions
    • The Java 8 IBM certpath provider does not honor the user specified system property for CLR connect timeout

This update for java-1_7_1-ibm fixes the following issues:

• Update to Java 7.1 Service Refresh 4 Fix Pack 75 [bsc#1180063, bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  • Class Libraries:
    • Z/OS specific C function send_file is changing the file pointer position
  • Security:
    • Add the new oracle signer certificate
    • Certificate parsing error
    • JVM memory growth can be caused by the IBMPKCS11IMPL crypto provider
    • Remove check for websphere signed jars
    • sessionid.hashcode generates too many collisions
    • The Java 8 IBM certpath provider does not honor the user specified system property for CLR connect timeout

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_7_0-openjdk fixes the following issues:

• Update to 2.6.24 - OpenJDK 7u281 (October 2020 CPU, bsc#1177943)
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 7 u281 build 1
    • JDK-8145096: Undefined behaviour in HotSpot
    • JDK-8215265: C2: range check elimination may allow illegal out of bound access
  • Backports
    • JDK-8250861, PR3812: Crash in MinINode::Ideal(PhaseGVN*, bool)

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803

  • Class libraries:

    • SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time that the set timeout
    • Z/OS specific C function send_file is changing the file pointer position

  • Java Virtual Machine:

    • Crash on iterate java stack
    • Java process hang on SIGTERM

  • JIT Compiler:

    • JMS performance regression from JDK8 SR5 FP40 TO FP41

  • Class Libraries:

    • z15 high utilization following Z/VM and Linux migration from z14 To z15

  • Java Virtual Machine:

    • Assertion failed when trying to write a class file
    • Assertion failure at modronapi.cpp
    • Improve the performance of defining and finding classes

  • JIT Compiler:

    • An assert in ppcbinaryencoding.cpp may trigger when running with traps disabled on power
    • AOT field offset off by n bytes
    • Segmentation fault in jit module on ibm z platform

This update for java-1_7_1-ibm fixes the following issues:

• Update to Java 7.1 Service Refresh 4 Fix Pack 75 [bsc#1180063, bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  • Class Libraries:
    • Z/OS specific C function send_file is changing the file pointer position
  • Security:
    • Add the new oracle signer certificate
    • Certificate parsing error
    • JVM memory growth can be caused by the IBMPKCS11IMPL crypto provider
    • Remove check for websphere signed jars
    • sessionid.hashcode generates too many collisions
    • The Java 8 IBM certpath provider does not honor the user specified system property for CLR connect timeout

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803

  • Class libraries:

    • SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time that the set timeout
    • Z/OS specific C function send_file is changing the file pointer position

  • Java Virtual Machine:

    • Crash on iterate java stack
    • Java process hang on SIGTERM

  • JIT Compiler:

    • JMS performance regression from JDK8 SR5 FP40 TO FP41

  • Class Libraries:

    • z15 high utilization following Z/VM and Linux migration from z14 To z15

  • Java Virtual Machine:

    • Assertion failed when trying to write a class file
    • Assertion failure at modronapi.cpp
    • Improve the performance of defining and finding classes

  • JIT Compiler:

    • An assert in ppcbinaryencoding.cpp may trigger when running with traps disabled on power
    • AOT field offset off by n bytes
    • Segmentation fault in jit module on ibm z platform

It was discovered that OpenJDK incorrectly handled deserializing Proxy class objects with many interfaces. A remote attacker could possibly use this issue to cause a denial of service (memory consumption) via a specially crafted input. (CVE-2020-14779)

Sergey Ostanin discovered that OpenJDK incorrectly restricted authentication mechanisms. A remote attacker could possibly use this issue to obtain sensitive information over an unencrypted connection. (CVE-2020-14781)

It was discovered that OpenJDK incorrectly handled untrusted certificates. An attacker could possibly use this issue to read or write sensitive information. (CVE-2020-14782)

Zhiqiang Zang discovered that OpenJDK incorrectly checked for integer overflows. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14792)

Markus Loewe discovered that OpenJDK incorrectly checked permissions when converting a file system path to an URI. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14796)

Markus Loewe discovered that OpenJDK incorrectly checked for invalid characters when converting an URI to a path. An attacker could possibly use this issue to read or write sensitive information. (CVE-2020-14797)

Markus Loewe discovered that OpenJDK incorrectly checked the length of input strings. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14798)

It was discovered that OpenJDK incorrectly handled boundary checks. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14803)

USN-4607-1 fixed vulnerabilities and added features in OpenJDK. Unfortunately, that update introduced a regression that could cause TLS connections with client certificate authentication to fail in some situations. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that OpenJDK incorrectly handled deserializing Proxy class objects with many interfaces. A remote attacker could possibly use this issue to cause a denial of service (memory consumption) via a specially crafted input. (CVE-2020-14779)

Sergey Ostanin discovered that OpenJDK incorrectly restricted authentication mechanisms. A remote attacker could possibly use this issue to obtain sensitive information over an unencrypted connection. (CVE-2020-14781)

It was discovered that OpenJDK incorrectly handled untrusted certificates. An attacker could possibly use this issue to read or write sensitive information. (CVE-2020-14782)

Zhiqiang Zang discovered that OpenJDK incorrectly checked for integer overflows. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14792)

Markus Loewe discovered that OpenJDK incorrectly checked permissions when converting a file system path to an URI. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14796)

Markus Loewe discovered that OpenJDK incorrectly checked for invalid characters when converting an URI to a path. An attacker could possibly use this issue to read or write sensitive information. (CVE-2020-14797)

Markus Loewe discovered that OpenJDK incorrectly checked the length of input strings. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14798)

It was discovered that OpenJDK incorrectly handled boundary checks. An attacker could possibly use this issue to bypass certain Java sandbox restrictions. (CVE-2020-14803)