CVE-2020-14803

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

• Bump to 2.6.28 and OpenJDK 7u351-b01.
• Security fixes in 7u351:
• CVE-2022-21540: Improve class compilation (JDK-8281859)
• CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
• CVE-2022-34169: Improve Xalan supports (JDK-8285407)
• Security fixes in 7u341:
• CVE-2022-21426: Better XPath expression handling (JDK-8270504)
• CVE-2022-21434: Better invocation handler handling (JDK-8277672)
• CVE-2022-21443: Improved Object Identification (JDK-8275151)
• CVE-2022-21476: Improve Santuario processing (JDK-8278008)
• CVE-2022-21496: Improve URL supports (JDK-8278972)
• Security fixes in 7u331:
• CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
• CVE-2022-21282: Better resolution of URIs (JDK-8270492)
• CVE-2022-21283: Better String matching (JDK-8268813)
• CVE-2022-21293: Improve String constructions (JDK-8270392)
• CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
• CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
• CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
• CVE-2022-21305: Better array indexing (JDK-8272014)
• CVE-2022-21340: Verify Jar Verification (JDK-8272026)
• CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
• CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
• CVE-2022-21360: Enhance BMP image support (JDK-8273756)
• CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
• Security fixes in 7u321:
• CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
• CVE-2021-35556: Richer Text Editors (JDK-8265167)
• CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
• CVE-2021-35561: Better hashing support (JDK-8266097)
• CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
• CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
• CVE-2021-35586: Better BMP support (JDK-8267735)
• CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
• CVE-2021-35603: Better session identification (JDK-8269618)
• Security fixes in 7u311:
• CVE-2021-2341: Improve file transfers (JDK-8258432)
• CVE-2021-2369: Better jar file validation (JDK-8260967)
• CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
• Security fixes in 7u301:
• CVE-2021-2161: Less ambiguous processing (JDK-8250568)
• CVE-2021-2163: Enhance opening JARs (JDK-8249906)
• Security fixes in 7u281:
• CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
• CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
• CVE-2020-14782: Enhance certificate processing (JDK-8237995)
• CVE-2020-14792: Better range handling (JDK-8241114)
• CVE-2020-14796: Improved URI Support (JDK-8242680)
• CVE-2020-14797: Better Path Validation (JDK-8242685)
• CVE-2020-14798: Enhanced buffer support (JDK-8242695)
• CVE-2020-14803: Improved Buffer supports (JDK-8244136)
• Security fixes in 7u271:
• CVE-2020-14577: Enhance certificate verification (JDK-8237592)
• CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
• CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
• CVE-2020-14581: Better matrix operations (JDK-8238002)
• CVE-2020-14583: Better Buffer support (JDK-8238920)
• CVE-2020-14593: Less Affine Transformations (JDK-8240119)
• CVE-2020-14621: Better XML namespace handling (JDK-8242136)
• Update tzdata requirement to 2022a to match JDK-8283350
• Update NEWS from IcedTea
• Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version

• Bump to 2.6.28 and OpenJDK 7u351-b01.
• Security fixes in 7u351:
• CVE-2022-21540: Improve class compilation (JDK-8281859)
• CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
• CVE-2022-34169: Improve Xalan supports (JDK-8285407)
• Security fixes in 7u341:
• CVE-2022-21426: Better XPath expression handling (JDK-8270504)
• CVE-2022-21434: Better invocation handler handling (JDK-8277672)
• CVE-2022-21443: Improved Object Identification (JDK-8275151)
• CVE-2022-21476: Improve Santuario processing (JDK-8278008)
• CVE-2022-21496: Improve URL supports (JDK-8278972)
• Security fixes in 7u331:
• CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
• CVE-2022-21282: Better resolution of URIs (JDK-8270492)
• CVE-2022-21283: Better String matching (JDK-8268813)
• CVE-2022-21293: Improve String constructions (JDK-8270392)
• CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
• CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
• CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
• CVE-2022-21305: Better array indexing (JDK-8272014)
• CVE-2022-21340: Verify Jar Verification (JDK-8272026)
• CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
• CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
• CVE-2022-21360: Enhance BMP image support (JDK-8273756)
• CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
• Security fixes in 7u321:
• CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
• CVE-2021-35556: Richer Text Editors (JDK-8265167)
• CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
• CVE-2021-35561: Better hashing support (JDK-8266097)
• CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
• CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
• CVE-2021-35586: Better BMP support (JDK-8267735)
• CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
• CVE-2021-35603: Better session identification (JDK-8269618)
• Security fixes in 7u311:
• CVE-2021-2341: Improve file transfers (JDK-8258432)
• CVE-2021-2369: Better jar file validation (JDK-8260967)
• CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
• Security fixes in 7u301:
• CVE-2021-2161: Less ambiguous processing (JDK-8250568)
• CVE-2021-2163: Enhance opening JARs (JDK-8249906)
• Security fixes in 7u281:
• CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
• CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
• CVE-2020-14782: Enhance certificate processing (JDK-8237995)
• CVE-2020-14792: Better range handling (JDK-8241114)
• CVE-2020-14796: Improved URI Support (JDK-8242680)
• CVE-2020-14797: Better Path Validation (JDK-8242685)
• CVE-2020-14798: Enhanced buffer support (JDK-8242695)
• CVE-2020-14803: Improved Buffer supports (JDK-8244136)
• Security fixes in 7u271:
• CVE-2020-14577: Enhance certificate verification (JDK-8237592)
• CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
• CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
• CVE-2020-14581: Better matrix operations (JDK-8238002)
• CVE-2020-14583: Better Buffer support (JDK-8238920)
• CVE-2020-14593: Less Affine Transformations (JDK-8240119)
• CVE-2020-14621: Better XML namespace handling (JDK-8242136)
• Update tzdata requirement to 2022a to match JDK-8283350
• Update NEWS from IcedTea
• Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version

High memory usage during deserialization of Proxy class with many interfaces. (CVE-2020-14779)

Credentials sent over unencrypted LDAP connection. (CVE-2020-14781)

Certificate blacklist bypass via alternate certificate encodings. (CVE-2020-14782)

Integer overflow leading to out-of-bounds access. (CVE-2020-14792)

Missing permission check in path to URI conversion. (CVE-2020-14796)

Incomplete check for invalid characters in URI to path conversion. (CVE-2020-14797)

Race condition in NIO Buffer boundary checks. (CVE-2020-14803)

Also, the timezone package has been updated to version 2020d.

This update for java-1_8_0-openj9 fixes the following issues:

-OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 (bsc#1174157) and October 2020 CPU (bsc#1177943)

• CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581, CVE-2020-14583, CVE-2020-14593, CVE-2020-14621, CVE-2020-14779, CVE-2020-14781, CVE-2020-14782, CVE-2020-14792, CVE-2020-14796, CVE-2020-14797, CVE-2020-14798 and CVE-2020-14803

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_8_0-openjdk fixes the following issues:

• Update to version jdk8u282 (icedtea 3.18.0)
  • January 2021 CPU (bsc#1181239)
  • Security fixes
    • JDK-8247619: Improve Direct Buffering of Characters (CVE-2020-14803)
  • Import of OpenJDK 8 u282 build 01
    • JDK-6962725: Regtest javax/swing/JFileChooser/6738668/ /bug6738668.java fails under Linux
    • JDK-8025936: Windows .pdb and .map files does not have proper dependencies setup
    • JDK-8030350: Enable additional compiler warnings for GCC
    • JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/ /DisposeFrameOnDragTest.java fails by Timeout on Windows
    • JDK-8036122: Fix warning 'format not a string literal'
    • JDK-8051853: new URI('x/').resolve('..').getSchemeSpecificPart() returns null!
    • JDK-8132664: closed/javax/swing/DataTransfer/DefaultNoDrop/ /DefaultNoDrop.java locks on Windows
    • JDK-8134632: Mark javax/sound/midi/Devices/ /InitializationHang.java as headful
    • JDK-8148854: Class names 'SomeClass' and 'LSomeClass;' treated by JVM as an equivalent
    • JDK-8148916: Mark bug6400879.java as intermittently failing
    • JDK-8148983: Fix extra comma in changes for JDK-8148916
    • JDK-8160438: javax/swing/plaf/nimbus/8057791/bug8057791.java fails
    • JDK-8165808: Add release barriers when allocating objects with concurrent collection
    • JDK-8185003: JMX: Add a version of ThreadMXBean.dumpAllThreads with a maxDepth argument
    • JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java on windows with VS2017
    • JDK-8207766: [testbug] Adapt tests for Aix.
    • JDK-8212070: Introduce diagnostic flag to abort VM on failed JIT compilation
    • JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash
    • JDK-8215727: Restore JFR thread sampler loop to old / previous behavior
    • JDK-8220657: JFR.dump does not work when filename is set
    • JDK-8221342: [TESTBUG] Generate Dockerfile for docker testing
    • JDK-8224502: [TESTBUG] JDK docker test TestSystemMetrics.java fails with access issues and OOM
    • JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes() can be quicker for self thread
    • JDK-8231968: getCurrentThreadAllocatedBytes default implementation s/b getThreadAllocatedBytes
    • JDK-8232114: JVM crashed at imjpapi.dll in native code
    • JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect numbers for Compiler area
    • JDK-8234339: replace JLI_StrTok in java_md_solinux.c
    • JDK-8238448: RSASSA-PSS signature verification fail when using certain odd key sizes
    • JDK-8242335: Additional Tests for RSASSA-PSS
    • JDK-8244225: stringop-overflow warning on strncpy call from compile_the_world_in
    • JDK-8245400: Upgrade to LittleCMS 2.11
    • JDK-8248214: Add paddings for TaskQueueSuper to reduce false-sharing cache contention
    • JDK-8249176: Update GlobalSignR6CA test certificates
    • JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY
    • JDK-8250928: JFR: Improve hash algorithm for stack traces
    • JDK-8251469: Better cleanup for test/jdk/javax/imageio/SetOutput.java
    • JDK-8251840: Java_sun_awt_X11_XToolkit_getDefaultScreenData should not be in make/mapfiles/libawt_xawt/mapfile-vers
    • JDK-8252384: [TESTBUG] Some tests refer to COMPAT provider rather than JRE
    • JDK-8252395: [8u] --with-native-debug-symbols=external doesn't include debuginfo files for binaries
    • JDK-8252497: Incorrect numeric currency code for ROL
    • JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent
    • JDK-8252904: VM crashes when JFR is used and JFR event class is transformed
    • JDK-8252975: [8u] JDK-8252395 breaks the build for --with-native-debug-symbols=internal
    • JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    • JDK-8253550: [8u] JDK-8252395 breaks the…

These are all security issues fixed in the java-11-openj9-11.0.11.0-3.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-15-openjdk-15.0.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openj9-1.8.0.292-3.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openj9 fixes the following issues:

• Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)

• Including OpenJ9/OMR specific fix:

  • CVE-2024-3933 (boo#1225470)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more

• Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine

  • Including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

• Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine

  • Including Oracle July 2022 CPU changes CVE-2022-21540 (boo#1201694), CVE-2022-21541 (boo#1201692), CVE-2022-34169 (boo#1201684)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.33

• Update to OpenJDK 11.0.15 with OpenJ9…

This update for java-1_7_0-ibm fixes the following issues:

• Update to Java 7.0 Service Refresh 10 Fix Pack 75 [bsc#1180063, bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  • Class Libraries:
    • Z/OS specific C function send_file is changing the file pointer position
  • Security:
    • Add the new oracle signer certificate
    • Certificate parsing error
    • JVM memory growth can be caused by the IBMPKCS11IMPL crypto provider
    • Remove check for websphere signed jars
    • sessionid.hashcode generates too many collisions
    • The Java 8 IBM certpath provider does not honor the user specified system property for CLR connect timeout

This update for java-1_7_1-ibm fixes the following issues:

• Update to Java 7.1 Service Refresh 4 Fix Pack 75 [bsc#1180063, bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  • Class Libraries:
    • Z/OS specific C function send_file is changing the file pointer position
  • Security:
    • Add the new oracle signer certificate
    • Certificate parsing error
    • JVM memory growth can be caused by the IBMPKCS11IMPL crypto provider
    • Remove check for websphere signed jars
    • sessionid.hashcode generates too many collisions
    • The Java 8 IBM certpath provider does not honor the user specified system property for CLR connect timeout

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_7_0-openjdk fixes the following issues:

• Update to 2.6.24 - OpenJDK 7u281 (October 2020 CPU, bsc#1177943)
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 7 u281 build 1
    • JDK-8145096: Undefined behaviour in HotSpot
    • JDK-8215265: C2: range check elimination may allow illegal out of bound access
  • Backports
    • JDK-8250861, PR3812: Crash in MinINode::Ideal(PhaseGVN*, bool)

This update for java-11-openjdk fixes the following issues:

• Update to upstream tag jdk-11.0.9-11 (October 2020 CPU, bsc#1177943)
  • New features
    • JDK-8250784: Shenandoah: A Low-Pause-Time Garbage Collector
  • Security fixes
    • JDK-8233624: Enhance JNI linkage
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8240124: Better VM Interning
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Other changes
    • JDK-6532025: GIF reader throws misleading exception with truncated images
    • JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/ /PDialogTest.java needs update by removing an infinite loop
    • JDK-8022535: [TEST BUG] javax/swing/text/html/parser/ /Test8017492.java fails
    • JDK-8062947: Fix exception message to correctly represent LDAP connection failure
    • JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed
    • JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/ /CloseServerSocket.java fails intermittently with Address already in use
    • JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
    • JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
    • JDK-8172404: Tools should warn if weak algorithms are used before restricting them
    • JDK-8193367: Annotated type variable bounds crash javac
    • JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset
    • JDK-8203026: java.rmi.NoSuchObjectException: no such object in table
    • JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called
    • JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass
    • JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout
    • JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java
    • JDK-8204963: javax.swing.border.TitledBorder has a memory leak
    • JDK-8204994: SA might fail to attach to process with 'Windbg Error: WaitForEvent failed'
    • JDK-8205534: Remove SymbolTable dependency from serviceability agent
    • JDK-8206309: Tier1 SA tests fail
    • JDK-8208281: java/nio/channels/ /AsynchronousSocketChannel/Basic.java timed out
    • JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1
    • JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect
    • JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!
    • JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful
    • JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout
    • JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2
    • JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC
    • JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java
    • JDK-8210131:…

This update for java-1_8_0-openjdk fixes the following issues:

• Fix regression '8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)', introduced in October 2020 CPU.

• Update to version jdk8u272 (icedtea 3.17.0) (July 2020 CPU, bsc#1174157, and October 2020 CPU, bsc#1177943)

  • New features
    • JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
    • PR3796: Allow the number of curves supported to be specified
  • Security fixes
    • JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
    • JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
    • JDK-8230613: Better ASCII conversions
    • JDK-8231800: Better listing of arrays
    • JDK-8232014: Expand DTD support
    • JDK-8233255: Better Swing Buttons
    • JDK-8233624: Enhance JNI linkage
    • JDK-8234032: Improve basic calendar services
    • JDK-8234042: Better factory production of certificates
    • JDK-8234418: Better parsing with CertificateFactory
    • JDK-8234836: Improve serialization handling
    • JDK-8236191: Enhance OID processing
    • JDK-8236196: Improve string pooling
    • JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
    • JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
    • JDK-8237592, CVE-2020-14577: Enhance certificate verification
    • JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
    • JDK-8237995, CVE-2020-14782: Enhance certificate processing
    • JDK-8238002, CVE-2020-14581: Better matrix operations
    • JDK-8238804: Enhance key handling process
    • JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
    • JDK-8238843: Enhanced font handing
    • JDK-8238920, CVE-2020-14583: Better Buffer support
    • JDK-8238925: Enhance WAV file playback
    • JDK-8240119, CVE-2020-14593: Less Affine Transformations
    • JDK-8240124: Better VM Interning
    • JDK-8240482: Improved WAV file playback
    • JDK-8241114, CVE-2020-14792: Better range handling
    • JDK-8241379: Update JCEKS support
    • JDK-8241522: Manifest improved jar headers redux
    • JDK-8242136, CVE-2020-14621: Better XML namespace handling
    • JDK-8242680, CVE-2020-14796: Improved URI Support
    • JDK-8242685, CVE-2020-14797: Better Path Validation
    • JDK-8242695, CVE-2020-14798: Enhanced buffer support
    • JDK-8243302: Advanced class supports
    • JDK-8244136, CVE-2020-14803: Improved Buffer supports
    • JDK-8244479: Further constrain certificates
    • JDK-8244955: Additional Fix for JDK-8240124
    • JDK-8245407: Enhance zoning of times
    • JDK-8245412: Better class definitions
    • JDK-8245417: Improve certificate chain handling
    • JDK-8248574: Improve jpeg processing
    • JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
    • JDK-8253019: Enhanced JPEG decoding
  • Import of OpenJDK 8 u262 build 01
    • JDK-4949105: Access Bridge lacks html tags parsing
    • JDK-8003209: JFR events for network utilization
    • JDK-8030680: 292 cleanup from default method code assessment
    • JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
    • JDK-8041626: Shutdown tracing event
    • JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
    • JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
    • JDK-8151582: (ch) test java/nio/channels/ /AsyncCloseAndInterrupt.java failing due to 'Connection succeeded'
    • JDK-8165675: Trace event for thread park has incorrect unit for timeout
    • JDK-8176182: 4 security tests are not run
    • JDK-8178910: Problemlist sample tests
    • JDK-8183925: Decouple crash protection from watcher thread
    • JDK-8191393: Random crashes during cfree+0x1c
    • JDK-8195817: JFR.stop should require name of recording
    • JDK-8195818: JFR.start should increase autogenerated name by one
    • JDK-8195819: Remove recording=x from jcmd…

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803

  • Class libraries:

    • SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time that the set timeout
    • Z/OS specific C function send_file is changing the file pointer position

  • Java Virtual Machine:

    • Crash on iterate java stack
    • Java process hang on SIGTERM

  • JIT Compiler:

    • JMS performance regression from JDK8 SR5 FP40 TO FP41

  • Class Libraries:

    • z15 high utilization following Z/VM and Linux migration from z14 To z15

  • Java Virtual Machine:

    • Assertion failed when trying to write a class file
    • Assertion failure at modronapi.cpp
    • Improve the performance of defining and finding classes

  • JIT Compiler:

    • An assert in ppcbinaryencoding.cpp may trigger when running with traps disabled on power
    • AOT field offset off by n bytes
    • Segmentation fault in jit module on ibm z platform

This update for java-1_7_1-ibm fixes the following issues:

• Update to Java 7.1 Service Refresh 4 Fix Pack 75 [bsc#1180063, bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14782 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803
  • Class Libraries:
    • Z/OS specific C function send_file is changing the file pointer position
  • Security:
    • Add the new oracle signer certificate
    • Certificate parsing error
    • JVM memory growth can be caused by the IBMPKCS11IMPL crypto provider
    • Remove check for websphere signed jars
    • sessionid.hashcode generates too many collisions
    • The Java 8 IBM certpath provider does not honor the user specified system property for CLR connect timeout

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803

  • Class libraries:

    • SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for more time that the set timeout
    • Z/OS specific C function send_file is changing the file pointer position

  • Java Virtual Machine:

    • Crash on iterate java stack
    • Java process hang on SIGTERM

  • JIT Compiler:

    • JMS performance regression from JDK8 SR5 FP40 TO FP41

  • Class Libraries:

    • z15 high utilization following Z/VM and Linux migration from z14 To z15

  • Java Virtual Machine:

    • Assertion failed when trying to write a class file
    • Assertion failure at modronapi.cpp
    • Improve the performance of defining and finding classes

  • JIT Compiler:

    • An assert in ppcbinaryencoding.cpp may trigger when running with traps disabled on power
    • AOT field offset off by n bytes
    • Segmentation fault in jit module on ibm z platform

This update for java-1_7_1-ibm fixes the following issues:

• Update to Java 7.1 Service Refresh 4 Fix Pack 80 [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  • CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
  • CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.

This update for java-1_8_0-openjdk fixes the following issues:

• Update to version jdk8u282 (icedtea 3.18.0)
  • January 2021 CPU (bsc#1181239)
  • Security fixes
    • JDK-8247619: Improve Direct Buffering of Characters (CVE-2020-14803)
  • Import of OpenJDK 8 u282 build 01
    • JDK-6962725: Regtest javax/swing/JFileChooser/6738668/ /bug6738668.java fails under Linux
    • JDK-8025936: Windows .pdb and .map files does not have proper dependencies setup
    • JDK-8030350: Enable additional compiler warnings for GCC
    • JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/ /DisposeFrameOnDragTest.java fails by Timeout on Windows
    • JDK-8036122: Fix warning 'format not a string literal'
    • JDK-8051853: new URI('x/').resolve('..').getSchemeSpecificPart() returns null!
    • JDK-8132664: closed/javax/swing/DataTransfer/DefaultNoDrop/ /DefaultNoDrop.java locks on Windows
    • JDK-8134632: Mark javax/sound/midi/Devices/ /InitializationHang.java as headful
    • JDK-8148854: Class names 'SomeClass' and 'LSomeClass;' treated by JVM as an equivalent
    • JDK-8148916: Mark bug6400879.java as intermittently failing
    • JDK-8148983: Fix extra comma in changes for JDK-8148916
    • JDK-8160438: javax/swing/plaf/nimbus/8057791/bug8057791.java fails
    • JDK-8165808: Add release barriers when allocating objects with concurrent collection
    • JDK-8185003: JMX: Add a version of ThreadMXBean.dumpAllThreads with a maxDepth argument
    • JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java on windows with VS2017
    • JDK-8207766: [testbug] Adapt tests for Aix.
    • JDK-8212070: Introduce diagnostic flag to abort VM on failed JIT compilation
    • JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash
    • JDK-8215727: Restore JFR thread sampler loop to old / previous behavior
    • JDK-8220657: JFR.dump does not work when filename is set
    • JDK-8221342: [TESTBUG] Generate Dockerfile for docker testing
    • JDK-8224502: [TESTBUG] JDK docker test TestSystemMetrics.java fails with access issues and OOM
    • JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes() can be quicker for self thread
    • JDK-8231968: getCurrentThreadAllocatedBytes default implementation s/b getThreadAllocatedBytes
    • JDK-8232114: JVM crashed at imjpapi.dll in native code
    • JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect numbers for Compiler area
    • JDK-8234339: replace JLI_StrTok in java_md_solinux.c
    • JDK-8238448: RSASSA-PSS signature verification fail when using certain odd key sizes
    • JDK-8242335: Additional Tests for RSASSA-PSS
    • JDK-8244225: stringop-overflow warning on strncpy call from compile_the_world_in
    • JDK-8245400: Upgrade to LittleCMS 2.11
    • JDK-8248214: Add paddings for TaskQueueSuper to reduce false-sharing cache contention
    • JDK-8249176: Update GlobalSignR6CA test certificates
    • JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY
    • JDK-8250928: JFR: Improve hash algorithm for stack traces
    • JDK-8251469: Better cleanup for test/jdk/javax/imageio/SetOutput.java
    • JDK-8251840: Java_sun_awt_X11_XToolkit_getDefaultScreenData should not be in make/mapfiles/libawt_xawt/mapfile-vers
    • JDK-8252384: [TESTBUG] Some tests refer to COMPAT provider rather than JRE
    • JDK-8252395: [8u] --with-native-debug-symbols=external doesn't include debuginfo files for binaries
    • JDK-8252497: Incorrect numeric currency code for ROL
    • JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent
    • JDK-8252904: VM crashes when JFR is used and JFR event class is transformed
    • JDK-8252975: [8u] JDK-8252395 breaks the build for --with-native-debug-symbols=internal
    • JDK-8253284: Zero OrderAccess barrier mappings are incorrect
    • JDK-8253550: [8u] JDK-8252395 breaks the…

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186, bsc#1181239, CVE-2020-27221, CVE-2020-14803]
  • CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
  • CVE-2020-14803: Unauthenticated attacker with network access via multiple protocols allows to compromise Java SE.