CVE-2023-22044

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
• OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
• OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
• harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
• OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
• OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)
• OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221655)
• Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-8] (BZ#2222368)

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)
• OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)
• OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)
• harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)
• OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)
• OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)
• OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221653)
• Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-9] (BZ#2222852)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

- CVE-2023-22006, CVE-2023-22036, CVE-2023-22041, CVE-2023-22044,
  CVE-2023-22045, CVE-2023-22049, CVE-2023-25193.
- Release notes:
  https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-July/024064.html

The updated packages fix security vulnerabilities and a file conflict :

Improper connection handling during TLS handshake. (CVE-2023-21930)

Incorrect enqueue of references in garbage collector. (CVE-2023-21954)

Certificate validation issue in TLS session negotiation. (CVE-2023-21967)

Swing HTML parsing issue. (CVE-2023-21939)

Incorrect handling of NULL characters in ProcessBuilder. (CVE-2023-21938)

Missing string checks for NULL characters. (CVE-2023-21937)

Missing check for slash characters in URI-to-path conversion. (CVE-2023-21968)

Array indexing integer overflow issue. (CVE-2023-22045)

Improper handling of slash characters in URI-to-path conversion. (CVE-2023-22049)

O(n^2) growth via consecutive marks. (CVE-2023-25193)

HTTP client insufficient file name validation. (CVE-2023-22006)

ZIP file parsing infinite loop. (CVE-2023-22036)

Modulo operator array indexing issue. (CVE-2023-22044)

Weakness in AES implementation. (CVE-2023-22041)

These are all security issues fixed in the java-11-openjdk-11.0.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openjdk-17.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-17-openj9 fixes the following issues:

• Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 17.0.12 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 17.0.11 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21068 (boo#1222983)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 17.0.10 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20932 (boo#1218908), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Update to OpenJDK 17.0.9 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374
  • CVE-2023-22025, boo#1216339

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 17.0.8.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 17.0.8 with OpenJ9 0.40.0 virtual machine

• Including Oracle July 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22044 (boo#1213479), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 17.0.7 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 17.0.6 with OpenJ9 0.36.0 virtual machine

  • including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 17.0.5 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

This update for java-11-openjdk fixes the following issues:

Updated to jdk-11.0.20+8 (July 2023 CPU):

• CVE-2023-22006: Fixed vulnerability in the network component (bsc#1213473).

• CVE-2023-22036: Fixed vulnerability in the utility component (bsc#1213474).

• CVE-2023-22041: Fixed vulnerability in the hotspot component (bsc#1213475).

• CVE-2023-22044: Fixed vulnerability in the hotspot component (bsc#1213479).

• CVE-2023-22045: Fixed vulnerability in the hotspot component (bsc#1213481).

• CVE-2023-22049: Fixed vulnerability in the libraries component (bsc#1213482).

• CVE-2023-25193: Fixed vulnerability in the embedded harfbuzz module (bsc#1207922).

• JDK-8298676: Enhanced Look and Feel

• JDK-8300285: Enhance TLS data handling

• JDK-8300596: Enhance Jar Signature validation

• JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1

• JDK-8302475: Enhance HTTP client file downloading

• JDK-8302483: Enhance ZIP performance

• JDK-8303376: Better launching of JDI

• JDK-8304468: Better array usages

• JDK-8305312: Enhanced path handling

• JDK-8308682: Enhance AES performance

Bugfixes:

- JDK-8171426: java/lang/ProcessBuilder/Basic.java failed with Stream closed
- JDK-8178806: Better exception logging in crypto code
- JDK-8187522: test/sun/net/ftp/FtpURLConnectionLeak.java timed out
- JDK-8209167: Use CLDR's time zone mappings for Windows
- JDK-8209546: Make sun/security/tools/keytool/autotest.sh to support macosx
- JDK-8209880: tzdb.dat is not reproducibly built
- JDK-8213531: Test javax/swing/border/TestTitledBorderLeak.java fails
- JDK-8214459: NSS source should be removed
- JDK-8214807: Improve handling of very old class files
- JDK-8215015: [TESTBUG] remove unneeded -Xfuture option from tests
- JDK-8215575: C2 crash: assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded
- JDK-8220093: Change to GCC 8.2 for building on Linux at Oracle
- JDK-8227257: javax/swing/JFileChooser/4847375/bug4847375.java fails with AssertionError
- JDK-8232853: AuthenticationFilter.Cache::remove may throw ConcurrentModificationException
- JDK-8243936: NonWriteable system properties are actually writeable
- JDK-8246383: NullPointerException in JceSecurity.getVerificationResult when using Entrust provider
- JDK-8248701: On Windows generated modules-deps.gmk can contain backslash-r (CR) characters
- JDK-8257856: Make ClassFileVersionsTest.java robust to JDK version updates
- JDK-8259530: Generated docs contain MIT/GPL-licenced works without reproducing the licence
- JDK-8263420: Incorrect function name in NSAccessibilityStaticText native peer implementation
- JDK-8264290: Create implementation for NSAccessibilityComponentGroup protocol peer
- JDK-8264304: Create implementation for NSAccessibilityToolbar protocol peer
- JDK-8265486: ProblemList javax/sound/midi/Sequencer/Recording.java on macosx-aarch64
- JDK-8268558: [TESTBUG] Case 2 in TestP11KeyFactoryGetRSAKeySpec is skipped
- JDK-8269746: C2: assert(!in->is_CFG()) failed: CFG Node with no controlling input?
- JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
- JDK-8275233: Incorrect line number reported in exception stack trace thrown from a lambda expression
- JDK-8275721: Name of UTC timezone in a locale changes  depending on previous code
- JDK-8275735: [linux] Remove deprecated Metrics api (kernel memory limit)
- JDK-8276880: Remove java/lang/RuntimeTests/exec/ExecWithDir as unnecessary
- JDK-8277775: Fixup bugids in RemoveDropTargetCrashTest.java -add 4357905
- JDK-8278434: timeouts in test java/time/test/java/time/format/TestZoneTextPrinterParser.java
- JDK-8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption
- JDK-8282077: PKCS11 provider C_sign() impl should handle CKR_BUFFER_TOO_SMALL error
- JDK-8282201: Consider removal of expiry check in…

This update for java-17-openjdk fixes the following issues:

Updated to version jdk-17.0.8+7 (July 2023 CPU):

• CVE-2023-22006: Fixed vulnerability in the network component (bsc#1213473).

• CVE-2023-22036: Fixed vulnerability in the utility component (bsc#1213474).

• CVE-2023-22041: Fixed vulnerability in the hotspot component (bsc#1213475).

• CVE-2023-22044: Fixed vulnerability in the hotspot component (bsc#1213479).

• CVE-2023-22045: Fixed vulnerability in the hotspot component (bsc#1213481).

• CVE-2023-22049: Fixed vulnerability in the libraries component (bsc#1213482).

• CVE-2023-25193: Fixed vulnerability in the embedded harfbuzz module (bsc#1207922).

• JDK-8294323: Improve Shared Class Data

• JDK-8296565: Enhanced archival support

• JDK-8298676, JDK-8300891: Enhanced Look and Feel

• JDK-8300285: Enhance TLS data handling

• JDK-8300596: Enhance Jar Signature validation

• JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1

• JDK-8302475: Enhance HTTP client file downloading

• JDK-8302483: Enhance ZIP performance

• JDK-8303376: Better launching of JDI

• JDK-8304460: Improve array usages

• JDK-8304468: Better array usages

• JDK-8305312: Enhanced path handling

• JDK-8308682: Enhance AES performance

Bugfixes:

• JDK-8178806: Better exception logging in crypto code
• JDK-8201516: DebugNonSafepoints generates incorrect information
• JDK-8224768: Test ActalisCA.java fails
• JDK-8227060: Optimize safepoint cleanup subtask order
• JDK-8227257: javax/swing/JFileChooser/4847375/bug4847375.java fails with AssertionError
• JDK-8238274: (sctp) JDK-7118373 is not fixed for SctpChannel
• JDK-8244976: vmTestbase/nsk/jdi/Event/request/request001.java doesn' initialize eName
• JDK-8245877: assert(_value != __null) failed: resolving NULL _value in JvmtiExport::post_compiled_method_load
• JDK-8248001: javadoc generates invalid HTML pages whose ftp:// links are broken
• JDK-8252990: Intrinsify Unsafe.storeStoreFence
• JDK-8254711: Add java.security.Provider.getService JFR Event
• JDK-8257856: Make ClassFileVersionsTest.java robust to JDK version updates
• JDK-8261495: Shenandoah: reconsider update references memory ordering
• JDK-8268288: jdk/jfr/api/consumer/streaming/ /TestOutOfProcessMigration.java fails with 'Error: ShouldNotReachHere()'
• JDK-8268298: jdk/jfr/api/consumer/log/TestVerbosity.java fails: unexpected log message
• JDK-8268582: javadoc throws NPE with --ignore-source-errors option
• JDK-8269821: Remove is-queue-active check in inner loop of write_ref_array_pre_work
• JDK-8270434: JDI+UT: Unexpected event in JDI tests
• JDK-8270859: Post JEP 411 refactoring: client libs with maximum covering > 10K
• JDK-8270869: G1ServiceThread may not terminate
• JDK-8271519: java/awt/event/SequencedEvent/ /MultipleContextsFunctionalTest.java failed with 'Total [200]
  • Expected [400]'
• JDK-8273909: vmTestbase/nsk/jdi/Event/request/request001 can still fail with 'ERROR: new event is not ThreadStartEvent'
• JDK-8274243: Implement fast-path for ASCII-compatible CharsetEncoders on aarch64
• JDK-8274615: Support relaxed atomic add for linux-aarch64
• JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
• JDK-8275233: Incorrect line number reported in exception stack trace thrown from a lambda expression
• JDK-8275287: Relax memory ordering constraints on updating instance class and array class counters
• JDK-8275721: Name of UTC timezone in a locale changes depending on previous code
• JDK-8275735: [linux] Remove deprecated Metrics api (kernel memory limit)
• JDK-8276058: Some swing test fails on specific CI macos system
• JDK-8277407: javax/swing/plaf/synth/SynthButtonUI/6276188/ /bug6276188.java fails to compile after JDK-8276058
• JDK-8277775: Fixup bugids in RemoveDropTargetCrashTest.java - add 4357905
• JDK-8278146: G1: Rework VM_G1Concurrent…

This update for java-11-openjdk fixes the following issues:

Updated to jdk-11.0.20+8 (July 2023 CPU):

• CVE-2023-22006: Fixed vulnerability in the network component (bsc#1213473).

• CVE-2023-22036: Fixed vulnerability in the utility component (bsc#1213474).

• CVE-2023-22041: Fixed vulnerability in the hotspot component (bsc#1213475).

• CVE-2023-22044: Fixed vulnerability in the hotspot component (bsc#1213479).

• CVE-2023-22045: Fixed vulnerability in the hotspot component (bsc#1213481).

• CVE-2023-22049: Fixed vulnerability in the libraries component (bsc#1213482).

• CVE-2023-25193: Fixed vulnerability in the embedded harfbuzz module (bsc#1207922).

• JDK-8298676: Enhanced Look and Feel

• JDK-8300285: Enhance TLS data handling

• JDK-8300596: Enhance Jar Signature validation

• JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1

• JDK-8302475: Enhance HTTP client file downloading

• JDK-8302483: Enhance ZIP performance

• JDK-8303376: Better launching of JDI

• JDK-8304468: Better array usages

• JDK-8305312: Enhanced path handling

• JDK-8308682: Enhance AES performance

Bugfixes:

• JDK-8171426: java/lang/ProcessBuilder/Basic.java failed with Stream closed
• JDK-8178806: Better exception logging in crypto code
• JDK-8187522: test/sun/net/ftp/FtpURLConnectionLeak.java timed out
• JDK-8209167: Use CLDR's time zone mappings for Windows
• JDK-8209546: Make sun/security/tools/keytool/autotest.sh to support macosx
• JDK-8209880: tzdb.dat is not reproducibly built
• JDK-8213531: Test javax/swing/border/TestTitledBorderLeak.java fails
• JDK-8214459: NSS source should be removed
• JDK-8214807: Improve handling of very old class files
• JDK-8215015: [TESTBUG] remove unneeded -Xfuture option from tests
• JDK-8215575: C2 crash: assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded
• JDK-8220093: Change to GCC 8.2 for building on Linux at Oracle
• JDK-8227257: javax/swing/JFileChooser/4847375/bug4847375.java fails with AssertionError
• JDK-8232853: AuthenticationFilter.Cache::remove may throw ConcurrentModificationException
• JDK-8243936: NonWriteable system properties are actually writeable
• JDK-8246383: NullPointerException in JceSecurity.getVerificationResult when using Entrust provider
• JDK-8248701: On Windows generated modules-deps.gmk can contain backslash-r (CR) characters
• JDK-8257856: Make ClassFileVersionsTest.java robust to JDK version updates
• JDK-8259530: Generated docs contain MIT/GPL-licenced works without reproducing the licence
• JDK-8263420: Incorrect function name in NSAccessibilityStaticText native peer implementation
• JDK-8264290: Create implementation for NSAccessibilityComponentGroup protocol peer
• JDK-8264304: Create implementation for NSAccessibilityToolbar protocol peer
• JDK-8265486: ProblemList javax/sound/midi/Sequencer/ /Recording.java on macosx-aarch64
• JDK-8268558: [TESTBUG] Case 2 in TestP11KeyFactoryGetRSAKeySpec is skipped
• JDK-8269746: C2: assert(!in->is_CFG()) failed: CFG Node with no controlling input?
• JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
• JDK-8275233: Incorrect line number reported in exception stack trace thrown from a lambda expression
• JDK-8275721: Name of UTC timezone in a locale changes depending on previous code
• JDK-8275735: [linux] Remove deprecated Metrics api (kernel memory limit)
• JDK-8276880: Remove java/lang/RuntimeTests/exec/ExecWithDir as unnecessary
• JDK-8277775: Fixup bugids in RemoveDropTargetCrashTest.java - add 4357905
• JDK-8278434: timeouts in test java/time/test/java/time/format/ /TestZoneTextPrinterParser.java
• JDK-8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption
• JDK-8282077: PKCS11 provider C_sign() impl should handle CKR_BUFFER_TOO_SMALL error
• JDK-8282201: Consider…

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)
• CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934)
• CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475)
• CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)
• CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)
• CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)
• CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474)
• CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922)
• CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473)

This update for java-1_8_0-ibm fixes the following issues:

• Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541)
• CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934)
• CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475)
• CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482)
• CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481)
• CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479)
• CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474)
• CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922)
• CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473)

Motoyasu Saburi discovered that OpenJDK incorrectly handled special characters in file name parameters. An attacker could possibly use this issue to insert, edit or obtain sensitive information. This issue only affected OpenJDK 11 and OpenJDK 17. (CVE-2023-22006)

Eirik Bjørsnøs discovered that OpenJDK incorrectly handled certain ZIP archives. An attacker could possibly use this issue to cause a denial of service. This issue only affected OpenJDK 11 and OpenJDK 17. (CVE-2023-22036)

David Stancu discovered that OpenJDK had a flaw in the AES cipher implementation. An attacker could possibly use this issue to obtain sensitive information. This issue only affected OpenJDK 11 and OpenJDK 17. (CVE-2023-22041)

Zhiqiang Zang discovered that OpenJDK incorrectly handled array accesses when using the binary '%' operator. An attacker could possibly use this issue to obtain sensitive information. This issue only affected OpenJDK 17. (CVE-2023-22044)

Zhiqiang Zang discovered that OpenJDK incorrectly handled array accesses. An attacker could possibly use this issue to obtain sensitive information. (CVE-2023-22045)

It was discovered that OpenJDK incorrectly sanitized URIs strings. An attacker could possibly use this issue to insert, edit or obtain sensitive information. (CVE-2023-22049)

It was discovered that OpenJDK incorrectly handled certain glyphs. An attacker could possibly use this issue to cause a denial of service. This issue only affected OpenJDK 11 and OpenJDK 17. (CVE-2023-25193)