CVE-2024-21012

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).(CVE-2024-20918)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2024-20932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).(CVE-2024-20918)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2024-20932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).(CVE-2024-20918)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2024-20932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).(CVE-2024-20918)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2024-20932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2024-21011)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2024-21012)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2024-21068)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-14556)

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-14562)

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2020-14573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2020-14577)

Vulnerability in the Java SE,…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-14556)

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-14562)

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2020-14573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2020-14577)

Vulnerability in the Java SE,…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-14556)

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-14562)

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2020-14573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2020-14577)

Vulnerability in the Java SE,…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-14556)

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-14562)

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2020-14573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2020-14577)

Vulnerability in the Java SE,…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2020-14556)

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2020-14562)

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2020-14573)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2020-14577)

Vulnerability in the Java SE,…

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011)

• OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068)

• OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094)

• OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

• OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011)
• OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068)
• OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085)
• OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094)
• OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011)
• OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068)
• OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094)
• OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011)
• OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068)
• OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

• Backport upstream's fixes from OpenJDK 11.0.23 release.
  • CVE-2024-21011: possible crash on long exception message in Hotspot.
  • CVE-2024-21012: incorrect performing a reverse DNS query in ConnectionPool class.
  • CVE-2024-21068: incorrect applying an unsigned integer left shift in Hotspot.
  • CVE-2024-21085: incorrect memory size validation by the NativeUnpack class.
  • CVE-2024-21094: possible C2 compilation error due to incorrect size validation and out of bounds array access in Hotspot.

• OpenJDK 11.0.25 release, build 9.
  • CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147, CVE-2024-21208, CVE-2024-21210, CVE-2024-21217, CVE-2024-21235.
  • Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-October/038512.html
  • d/control, d/rules: bump dependency from jtreg6 to jtreg7
  • d/rules: build --without-jtreg if with_check is false, change location of --with-jtreg, change definition of min_jtreg_version
• Adjust patches
  • debian/patches/jtreg-location.diff (removed from d/p/series)
  • debian/patches/reproducible-javadoc-timestamp.diff
  • debian/patches/reproducible-copyright-headers.diff
  • debian/patches/nss-limited-ecc-tests.patch (added from Debian sources)
• Remove patches that became part of the update
  • debian/patches/CVE-2024-21011.patch
  • debian/patches/CVE-2024-21012.patch
  • debian/patches/CVE-2024-21068.patch
  • debian/patches/CVE-2024-21085.patch
  • debian/patches/CVE-2024-21094.patch

• Security fixes from OpenJDK 8u452-b09:
• CVE-2025-21587: JSSE issue allowing remote access or modification of sensitive data
• CVE-2025-30698: allows limited data access and partial DoS via untrusted Java code
• CVE-2025-30691: allows limited data access via untrusted code using compiler APIs
• Security fixes from OpenJDK 8u442-b06:
• CVE-2025-21502: hotspot vulnerability enabling limited data access java clients
• Security fixes from OpenJDK 8u432-b06:
• CVE-2024-21235: sandbox bypass in java clients via exposed APIs
• CVE-2024-21208: network flaw in sandboxed java clients enabling limited DoS
• CVE-2024-21210: enabling data modification in sandboxed clients via crafted API input
• CVE-2024-21217: serialization flaw may trigger partial DoS in sandboxed environments
• Security fixes from OpenJDK 8u422-b05:
• CVE-2024-21147: hotspot issue may lead to unauthorized access of sensitive data
• CVE-2024-21145: enable limited unauthorized data access via untrusted java code
• CVE-2024-21140: expose limited data to unauthorized read/write via sandboxed java code
• CVE-2024-21144: allow remote unauthenticated attacker to cause partial DoS
• CVE-2024-21131: remote access via API may lead to limited data modification
• CVE-2024-21138: remote API calls may trigger partial DoS in sandboxed java environments
• Security fixes from OpenJDK 8u412-b08:
• CVE-2024-21094: lead to unauthorized data changes in sandboxed java apps
• CVE-2024-21085: concurrency flaw may cause partial DoS in sandboxed java environments
• CVE-2024-21011: hotspot issue may trigger partial DoS in sandboxed java environments
• CVE-2024-21068: lead to limited unauthorized data modification in sandboxed deployments
• CVE-2024-21012: networking issue may allow limited data modification

Long Exception message leading to crash. (CVE-2024-21011) HTTP/2 client improper reverse DNS lookup. (CVE-2024-21012) Integer overflow in C1 compiler address generation. (CVE-2024-21068) Pack200 excessive memory allocation. (CVE-2024-21085) C2 compilation fails with "Exceeded _node_regs array". (CVE-2024-21094)

These are all security issues fixed in the java-11-openjdk-11.0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openjdk-17.0.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openjdk-21.0.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-22-openjdk-22.0.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openj9-11.0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openj9-17.0.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openj9-21.0.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openj9 fixes the following issues:

• Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)

• Including OpenJ9/OMR specific fix:

  • CVE-2024-3933 (boo#1225470)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more

• Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine

  • Including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

• Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine

  • Including Oracle July 2022 CPU changes CVE-2022-21540 (boo#1201694), CVE-2022-21541 (boo#1201692), CVE-2022-34169 (boo#1201684)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.33

• Update to OpenJDK 11.0.15 with OpenJ9…

This update for java-17-openj9 fixes the following issues:

• Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 17.0.12 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 17.0.11 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21068 (boo#1222983)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 17.0.10 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20932 (boo#1218908), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Update to OpenJDK 17.0.9 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374
  • CVE-2023-22025, boo#1216339

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 17.0.8.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 17.0.8 with OpenJ9 0.40.0 virtual machine

• Including Oracle July 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22044 (boo#1213479), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 17.0.7 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 17.0.6 with OpenJ9 0.36.0 virtual machine

  • including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 17.0.5 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

• OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011)

• OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068)

• OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085)

• OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094)

• OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011)

• OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068)

• OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for java-11-openjdk fixes the following issues:

• CVE-2024-21011: Fixed denial of service due to long Exception message logging (JDK-8319851,bsc#1222979)
• CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup (JDK-8315708,bsc#1222987)
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (JDK-8322122,bsc#1222983)
• CVE-2024-21085: Fixed denial of service due to Pack200 excessive memory allocation (JDK-8322114,bsc#1222984)
• CVE-2024-21094: Fixed unauthorized data modification due to C2 compilation failure with 'Exceeded _node_regs array' (JDK-8317507,JDK-8325348,bsc#1222986)

Other fixes:

• Upgrade to upstream tag jdk-11.0.23+9 (April 2024 CPU)
  • Security fixes
    • JDK-8318340: Improve RSA key implementations
  • Other changes
    • JDK-6928542: Chinese characters in RTF are not decoded
    • JDK-7132796: [macosx] closed/javax/swing/JComboBox/4517214/ /bug4517214.java fails on MacOS
    • JDK-7148092: [macosx] When Alt+down arrow key is pressed, the combobox popup does not appear.
    • JDK-8054022: HttpURLConnection timeouts with Expect: 100-Continue and no chunking
    • JDK-8054572: [macosx] JComboBox paints the border incorrectly
    • JDK-8058176: [mlvm] tests should not allow code cache exhaustion
    • JDK-8067651: LevelTransitionTest.java, fix trivial methods levels logic
    • JDK-8068225: nsk/jdi/EventQueue/remove_l/remove_l005 intermittently times out
    • JDK-8156889: ListKeychainStore.sh fails in some virtualized environments
    • JDK-8166275: vm/mlvm/meth/stress/compiler/deoptimize keeps timeouting
    • JDK-8166554: Avoid compilation blocking in OverloadCompileQueueTest.java
    • JDK-8169475: WheelModifier.java fails by timeout
    • JDK-8180266: Convert sun/security/provider/KeyStore/DKSTest.sh to Java Jtreg Test
    • JDK-8186610: move ModuleUtils to top-level testlibrary
    • JDK-8192864: defmeth tests can hide failures
    • JDK-8193543: Regression automated test '/open/test/jdk/java/ /awt/TrayIcon/SystemTrayInstance/SystemTrayInstanceTest.java' fails
    • JDK-8198668: MemoryPoolMBean/isUsageThresholdExceeded/ /isexceeded001/TestDescription.java still failing
    • JDK-8202282: [TESTBUG] appcds TestCommon .makeCommandLineForAppCDS() can be removed
    • JDK-8202790: DnD test DisposeFrameOnDragTest.java does not clean up
    • JDK-8202931: [macos] java/awt/Choice/ChoicePopupLocation/ /ChoicePopupLocation.java fails
    • JDK-8207211: [TESTBUG] Remove excessive output from CDS/AppCDS tests
    • JDK-8207214: Broken links in JDK API serialized-form page
    • JDK-8207855: Make applications/jcstress invoke tests in batches
    • JDK-8208243: vmTestbase/gc/lock/jni/jnilock002/ /TestDescription.java fails in jdk/hs nightly
    • JDK-8208278: [mlvm] [TESTBUG] vm.mlvm.mixed.stress.java .findDeadlock.INDIFY_Test Deadlocked threads are not always detected
    • JDK-8208623: [TESTBUG] runtime/LoadClass/LongBCP.java fails in AUFS file system
    • JDK-8208699: remove unneeded imports from runtime tests
    • JDK-8208704: runtime/appcds/MultiReleaseJars.java timed out often in hs-tier7 testing
    • JDK-8208705: [TESTBUG] The -Xlog:cds,cds+hashtables vm option is not always required for appcds tests
    • JDK-8209549: remove VMPropsExt from TEST.ROOT
    • JDK-8209595: MonitorVmStartTerminate.java timed out
    • JDK-8209946: [TESTBUG] CDS tests should use '@run driver'
    • JDK-8211438: [Testbug] runtime/XCheckJniJsig/XCheckJSig.java looks for libjsig in wrong location
    • JDK-8211978: Move testlibrary/jdk/testlibrary/ /SimpleSSLContext.java and testkeys to network testlibrary
    • JDK-8213622: Windows VS2013 build failure - ''snprintf': identifier not found'
    • JDK-8213926: WB_EnqueueInitializerForCompilation requests compilation for NULL +…

This update for java-11-openjdk fixes the following issues:

• CVE-2024-21011: Fixed denial of service due to long Exception message logging (JDK-8319851,bsc#1222979)
• CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup (JDK-8315708,bsc#1222987)
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (JDK-8322122,bsc#1222983)
• CVE-2024-21085: Fixed denial of service due to Pack200 excessive memory allocation (JDK-8322114,bsc#1222984)
• CVE-2024-21094: Fixed unauthorized data modification due to C2 compilation failure with 'Exceeded _node_regs array' (JDK-8317507,JDK-8325348,bsc#1222986)

Other fixes:

• Upgrade to upstream tag jdk-11.0.23+9 (April 2024 CPU)
  • Security fixes
    • JDK-8318340: Improve RSA key implementations
  • Other changes
    • JDK-6928542: Chinese characters in RTF are not decoded
    • JDK-7132796: [macosx] closed/javax/swing/JComboBox/4517214/ /bug4517214.java fails on MacOS
    • JDK-7148092: [macosx] When Alt+down arrow key is pressed, the combobox popup does not appear.
    • JDK-8054022: HttpURLConnection timeouts with Expect: 100-Continue and no chunking
    • JDK-8054572: [macosx] JComboBox paints the border incorrectly
    • JDK-8058176: [mlvm] tests should not allow code cache exhaustion
    • JDK-8067651: LevelTransitionTest.java, fix trivial methods levels logic
    • JDK-8068225: nsk/jdi/EventQueue/remove_l/remove_l005 intermittently times out
    • JDK-8156889: ListKeychainStore.sh fails in some virtualized environments
    • JDK-8166275: vm/mlvm/meth/stress/compiler/deoptimize keeps timeouting
    • JDK-8166554: Avoid compilation blocking in OverloadCompileQueueTest.java
    • JDK-8169475: WheelModifier.java fails by timeout
    • JDK-8180266: Convert sun/security/provider/KeyStore/DKSTest.sh to Java Jtreg Test
    • JDK-8186610: move ModuleUtils to top-level testlibrary
    • JDK-8192864: defmeth tests can hide failures
    • JDK-8193543: Regression automated test '/open/test/jdk/java/ /awt/TrayIcon/SystemTrayInstance/SystemTrayInstanceTest.java' fails
    • JDK-8198668: MemoryPoolMBean/isUsageThresholdExceeded/ /isexceeded001/TestDescription.java still failing
    • JDK-8202282: [TESTBUG] appcds TestCommon .makeCommandLineForAppCDS() can be removed
    • JDK-8202790: DnD test DisposeFrameOnDragTest.java does not clean up
    • JDK-8202931: [macos] java/awt/Choice/ChoicePopupLocation/ /ChoicePopupLocation.java fails
    • JDK-8207211: [TESTBUG] Remove excessive output from CDS/AppCDS tests
    • JDK-8207214: Broken links in JDK API serialized-form page
    • JDK-8207855: Make applications/jcstress invoke tests in batches
    • JDK-8208243: vmTestbase/gc/lock/jni/jnilock002/ /TestDescription.java fails in jdk/hs nightly
    • JDK-8208278: [mlvm] [TESTBUG] vm.mlvm.mixed.stress.java .findDeadlock.INDIFY_Test Deadlocked threads are not always detected
    • JDK-8208623: [TESTBUG] runtime/LoadClass/LongBCP.java fails in AUFS file system
    • JDK-8208699: remove unneeded imports from runtime tests
    • JDK-8208704: runtime/appcds/MultiReleaseJars.java timed out often in hs-tier7 testing
    • JDK-8208705: [TESTBUG] The -Xlog:cds,cds+hashtables vm option is not always required for appcds tests
    • JDK-8209549: remove VMPropsExt from TEST.ROOT
    • JDK-8209595: MonitorVmStartTerminate.java timed out
    • JDK-8209946: [TESTBUG] CDS tests should use '@run driver'
    • JDK-8211438: [Testbug] runtime/XCheckJniJsig/XCheckJSig.java looks for libjsig in wrong location
    • JDK-8211978: Move testlibrary/jdk/testlibrary/ /SimpleSSLContext.java and testkeys to network testlibrary
    • JDK-8213622: Windows VS2013 build failure - ''snprintf': identifier not found'
    • JDK-8213926: WB_EnqueueInitializerForCompilation requests compilation for NULL +…

This update for java-11-openjdk fixes the following issues:

• CVE-2024-21011: Fixed denial of service due to long Exception message logging (JDK-8319851,bsc#1222979)
• CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup (JDK-8315708,bsc#1222987)
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (JDK-8322122,bsc#1222983)
• CVE-2024-21085: Fixed denial of service due to Pack200 excessive memory allocation (JDK-8322114,bsc#1222984)
• CVE-2024-21094: Fixed unauthorized data modification due to C2 compilation failure with 'Exceeded _node_regs array' (JDK-8317507,JDK-8325348,bsc#1222986)

Other fixes:

• Upgrade to upstream tag jdk-11.0.23+9 (April 2024 CPU)
  • Security fixes
    • JDK-8318340: Improve RSA key implementations
  • Other changes
    • JDK-6928542: Chinese characters in RTF are not decoded
    • JDK-7132796: [macosx] closed/javax/swing/JComboBox/4517214/ /bug4517214.java fails on MacOS
    • JDK-7148092: [macosx] When Alt+down arrow key is pressed, the combobox popup does not appear.
    • JDK-8054022: HttpURLConnection timeouts with Expect: 100-Continue and no chunking
    • JDK-8054572: [macosx] JComboBox paints the border incorrectly
    • JDK-8058176: [mlvm] tests should not allow code cache exhaustion
    • JDK-8067651: LevelTransitionTest.java, fix trivial methods levels logic
    • JDK-8068225: nsk/jdi/EventQueue/remove_l/remove_l005 intermittently times out
    • JDK-8156889: ListKeychainStore.sh fails in some virtualized environments
    • JDK-8166275: vm/mlvm/meth/stress/compiler/deoptimize keeps timeouting
    • JDK-8166554: Avoid compilation blocking in OverloadCompileQueueTest.java
    • JDK-8169475: WheelModifier.java fails by timeout
    • JDK-8180266: Convert sun/security/provider/KeyStore/DKSTest.sh to Java Jtreg Test
    • JDK-8186610: move ModuleUtils to top-level testlibrary
    • JDK-8192864: defmeth tests can hide failures
    • JDK-8193543: Regression automated test '/open/test/jdk/java/ /awt/TrayIcon/SystemTrayInstance/SystemTrayInstanceTest.java' fails
    • JDK-8198668: MemoryPoolMBean/isUsageThresholdExceeded/ /isexceeded001/TestDescription.java still failing
    • JDK-8202282: [TESTBUG] appcds TestCommon .makeCommandLineForAppCDS() can be removed
    • JDK-8202790: DnD test DisposeFrameOnDragTest.java does not clean up
    • JDK-8202931: [macos] java/awt/Choice/ChoicePopupLocation/ /ChoicePopupLocation.java fails
    • JDK-8207211: [TESTBUG] Remove excessive output from CDS/AppCDS tests
    • JDK-8207214: Broken links in JDK API serialized-form page
    • JDK-8207855: Make applications/jcstress invoke tests in batches
    • JDK-8208243: vmTestbase/gc/lock/jni/jnilock002/ /TestDescription.java fails in jdk/hs nightly
    • JDK-8208278: [mlvm] [TESTBUG] vm.mlvm.mixed.stress.java .findDeadlock.INDIFY_Test Deadlocked threads are not always detected
    • JDK-8208623: [TESTBUG] runtime/LoadClass/LongBCP.java fails in AUFS file system
    • JDK-8208699: remove unneeded imports from runtime tests
    • JDK-8208704: runtime/appcds/MultiReleaseJars.java timed out often in hs-tier7 testing
    • JDK-8208705: [TESTBUG] The -Xlog:cds,cds+hashtables vm option is not always required for appcds tests
    • JDK-8209549: remove VMPropsExt from TEST.ROOT
    • JDK-8209595: MonitorVmStartTerminate.java timed out
    • JDK-8209946: [TESTBUG] CDS tests should use '@run driver'
    • JDK-8211438: [Testbug] runtime/XCheckJniJsig/XCheckJSig.java looks for libjsig in wrong location
    • JDK-8211978: Move testlibrary/jdk/testlibrary/ /SimpleSSLContext.java and testkeys to network testlibrary
    • JDK-8213622: Windows VS2013 build failure - ''snprintf': identifier not found'
    • JDK-8213926: WB_EnqueueInitializerForCompilation requests compilation for NULL +…

This update for java-17-openjdk fixes the following issues:

• CVE-2024-21011: Fixed denial of service due to long Exception message logging (JDK-8319851,bsc#1222979)
• CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup (JDK-8315708,bsc#1222987)
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (JDK-8322122,bsc#1222983)
• CVE-2024-21094: Fixed unauthorized data modification due to C2 compilation failure with 'Exceeded _node_regs array' (JDK-8317507,JDK-8325348,bsc#1222986)

Other fixes:

• Update to upstream tag jdk-17.0.11+9 (April 2024 CPU)
  • Security fixes
    • JDK-8318340: Improve RSA key implementations
  • Other changes
    • JDK-6928542: Chinese characters in RTF are not decoded
    • JDK-7132796: [macosx] closed/javax/swing/JComboBox/4517214/ /bug4517214.java fails on MacOS
    • JDK-7148092: [macosx] When Alt+down arrow key is pressed, the combobox popup does not appear.
    • JDK-7167356: (javac) investigate failing tests in JavacParserTest
    • JDK-8054022: HttpURLConnection timeouts with Expect: 100-Continue and no chunking
    • JDK-8054572: [macosx] JComboBox paints the border incorrectly
    • JDK-8169475: WheelModifier.java fails by timeout
    • JDK-8205076: [17u] Inet6AddressImpl.c: lookupIfLocalHost accesses int InetAddress.preferIPv6Address as a boolean
    • JDK-8209595: MonitorVmStartTerminate.java timed out
    • JDK-8210410: Refactor java.util.Currency:i18n shell tests to plain java tests
    • JDK-8261404: Class.getReflectionFactory() is not thread-safe
    • JDK-8261837: SIGSEGV in ciVirtualCallTypeData::translate_from
    • JDK-8263256: Test java/net/Inet6Address/serialize/ /Inet6AddressSerializationTest.java fails due to dynamic reconfigurations of network interface during test
    • JDK-8269258: java/net/httpclient/ManyRequestsLegacy.java failed with connection timeout
    • JDK-8271118: C2: StressGCM should have higher priority than frequency-based policy
    • JDK-8271616: oddPart in MutableBigInteger::mutableModInverse contains info on final result
    • JDK-8272811: Document the effects of building with _GNU_SOURCE in os_posix.hpp
    • JDK-8272853: improve JavadocTester.runTests
    • JDK-8273454: C2: Transform (-a)(-b) into ab
    • JDK-8274060: C2: Incorrect computation after JDK-8273454
    • JDK-8274122: java/io/File/createTempFile/SpecialTempFile.java fails in Windows 11
    • JDK-8274621: NullPointerException because listenAddress[0] is null
    • JDK-8274632: Possible pointer overflow in PretouchTask chunk claiming
    • JDK-8274634: Use String.equals instead of String.compareTo in java.desktop
    • JDK-8276125: RunThese24H.java SIGSEGV in JfrThreadGroup::thread_group_id
    • JDK-8278028: [test-library] Warnings cleanup of the test library
    • JDK-8278312: Update SimpleSSLContext keystore to use SANs for localhost IP addresses
    • JDK-8278363: Create extented container test groups
    • JDK-8280241: (aio) AsynchronousSocketChannel init fails in IPv6 only Windows env
    • JDK-8281377: Remove vmTestbase/nsk/monitoring/ThreadMXBean/ /ThreadInfo/Deadlock/JavaDeadlock001/TestDescription.java from problemlist.
    • JDK-8281543: Remove unused code/headerfile dtraceAttacher.hpp
    • JDK-8281585: Remove unused imports under test/lib and jtreg/gc
    • JDK-8283400: [macos] a11y : Screen magnifier does not reflect JRadioButton value change
    • JDK-8283626: AArch64: Set relocInfo::offset_unit to 4
    • JDK-8283994: Make Xerces DatatypeException stackless
    • JDK-8286312: Stop mixing signed and unsigned types in bit operations
    • JDK-8286846: test/jdk/javax/swing/plaf/aqua/ /CustomComboBoxFocusTest.java fails on mac aarch64
    • JDK-8287832: jdk/jfr/event/runtime/TestActiveSettingEvent.java failed with 'Expected two batches of Active Setting…

This update for java-17-openjdk fixes the following issues:

• CVE-2024-21011: Fixed denial of service due to long Exception message logging (JDK-8319851,bsc#1222979)
• CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup (JDK-8315708,bsc#1222987)
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (JDK-8322122,bsc#1222983)
• CVE-2024-21094: Fixed unauthorized data modification due to C2 compilation failure with 'Exceeded _node_regs array' (JDK-8317507,JDK-8325348,bsc#1222986)

Other fixes:

• Update to upstream tag jdk-17.0.11+9 (April 2024 CPU)
  • Security fixes
    • JDK-8318340: Improve RSA key implementations
  • Other changes
    • JDK-6928542: Chinese characters in RTF are not decoded
    • JDK-7132796: [macosx] closed/javax/swing/JComboBox/4517214/ /bug4517214.java fails on MacOS
    • JDK-7148092: [macosx] When Alt+down arrow key is pressed, the combobox popup does not appear.
    • JDK-7167356: (javac) investigate failing tests in JavacParserTest
    • JDK-8054022: HttpURLConnection timeouts with Expect: 100-Continue and no chunking
    • JDK-8054572: [macosx] JComboBox paints the border incorrectly
    • JDK-8169475: WheelModifier.java fails by timeout
    • JDK-8205076: [17u] Inet6AddressImpl.c: lookupIfLocalHost accesses int InetAddress.preferIPv6Address as a boolean
    • JDK-8209595: MonitorVmStartTerminate.java timed out
    • JDK-8210410: Refactor java.util.Currency:i18n shell tests to plain java tests
    • JDK-8261404: Class.getReflectionFactory() is not thread-safe
    • JDK-8261837: SIGSEGV in ciVirtualCallTypeData::translate_from
    • JDK-8263256: Test java/net/Inet6Address/serialize/ /Inet6AddressSerializationTest.java fails due to dynamic reconfigurations of network interface during test
    • JDK-8269258: java/net/httpclient/ManyRequestsLegacy.java failed with connection timeout
    • JDK-8271118: C2: StressGCM should have higher priority than frequency-based policy
    • JDK-8271616: oddPart in MutableBigInteger::mutableModInverse contains info on final result
    • JDK-8272811: Document the effects of building with _GNU_SOURCE in os_posix.hpp
    • JDK-8272853: improve JavadocTester.runTests
    • JDK-8273454: C2: Transform (-a)(-b) into ab
    • JDK-8274060: C2: Incorrect computation after JDK-8273454
    • JDK-8274122: java/io/File/createTempFile/SpecialTempFile.java fails in Windows 11
    • JDK-8274621: NullPointerException because listenAddress[0] is null
    • JDK-8274632: Possible pointer overflow in PretouchTask chunk claiming
    • JDK-8274634: Use String.equals instead of String.compareTo in java.desktop
    • JDK-8276125: RunThese24H.java SIGSEGV in JfrThreadGroup::thread_group_id
    • JDK-8278028: [test-library] Warnings cleanup of the test library
    • JDK-8278312: Update SimpleSSLContext keystore to use SANs for localhost IP addresses
    • JDK-8278363: Create extented container test groups
    • JDK-8280241: (aio) AsynchronousSocketChannel init fails in IPv6 only Windows env
    • JDK-8281377: Remove vmTestbase/nsk/monitoring/ThreadMXBean/ /ThreadInfo/Deadlock/JavaDeadlock001/TestDescription.java from problemlist.
    • JDK-8281543: Remove unused code/headerfile dtraceAttacher.hpp
    • JDK-8281585: Remove unused imports under test/lib and jtreg/gc
    • JDK-8283400: [macos] a11y : Screen magnifier does not reflect JRadioButton value change
    • JDK-8283626: AArch64: Set relocInfo::offset_unit to 4
    • JDK-8283994: Make Xerces DatatypeException stackless
    • JDK-8286312: Stop mixing signed and unsigned types in bit operations
    • JDK-8286846: test/jdk/javax/swing/plaf/aqua/ /CustomComboBoxFocusTest.java fails on mac aarch64
    • JDK-8287832: jdk/jfr/event/runtime/TestActiveSettingEvent.java failed with 'Expected two batches of Active Setting…

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 25 (bsc#1223470):

• CVE-2023-38264: Fixed Object Request Broker (ORB) denial of service (bsc#1224164).
• CVE-2024-21094: Fixed C2 compilation fails with 'Exceeded _node_regs array' (bsc#1222986).
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983).
• CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984).
• CVE-2024-21011: Fixed Long Exception message leading to crash (bsc#1222979).
• CVE-2024-21012: Fixed HTTP/2 client improper reverse DNS lookup (bsc#1222987).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 25 (bsc#1223470):

• CVE-2023-38264: Fixed Object Request Broker (ORB) denial of service (bsc#1224164).
• CVE-2024-21094: Fixed C2 compilation fails with 'Exceeded _node_regs array' (bsc#1222986).
• CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983).
• CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984).
• CVE-2024-21011: Fixed Long Exception message leading to crash (bsc#1222979).
• CVE-2024-21012: Fixed HTTP/2 client improper reverse DNS lookup (bsc#1222987).