CVE-2018-2634

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).

Multiple flaws were found in the Hotspot and AWT components of OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2018-2582, CVE-2018-2641).

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data (CVE-2018-2633).

The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that this could cause global credentials to be unexpectedly used by an untrusted Java application (CVE-2018-2634).

It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended deserialization restrictions (CVE-2018-2637).

It was discovered that the LDAP component of OpenJDK failed to properly encode special characters in user names when adding them to an LDAP search query. A remote attacker could possibly use this flaw to manipulate LDAP queries performed by the LdapLoginModule class (CVE-2018-2588).

It was discovered that the DNS client implementation in the JNDI component of OpenJDK did not use random source ports when sending out DNS queries. This could make it easier for a remote attacker to spoof responses to those queries (CVE-2018-2599).

It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file (CVE-2018-2602).

It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER encoded input (CVE-2018-2603).

It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using the negotiated secret (CVE-2018-2618).

It was discovered that the JGSS component of OpenJDK failed to properly handle GSS context in the native GSS library wrapper in certain cases. A remote attacker could possibly make a Java application using JGSS to use a previously freed context (CVE-2018-2629).

It was discovered that multiple classes in the Libraries, AWT, and JNDI components of OpenJDK did not sufficiently validate input when creating object instances from the serialized form. A specially-crafted input could cause a Java application to create objects with an inconsistent state or use an excessive amount of memory when deserialized (CVE-2018-2663, CVE-2018-2677, CVE-2018-2678).

It was discovered that multiple encryption key classes in the Libraries component of OpenJDK did not properly synchronize access to their internal data. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of the use of a key that was zeroed out (CVE-2018-2579).

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-1_7_1-ibm provides the following fix:

The version was updated to 7.1.4.20 [bsc#1082810]

• Security fixes:

  • CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

• Defect fixes:

  • IJ04281 Class Libraries: Startup time increase after applying apar IV96905
  • IJ03822 Class Libraries: Update timezone information to tzdata2017c
  • IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default
  • IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms
  • IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01
  • IJ04282 Security: Change in location and default of jurisdiction policy files
  • IJ03853 Security: IBMCAC provider does not support SHA224
  • IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally
  • IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally
  • IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute
  • IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception
  • IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman
  • IJ03256 Security: javax.security.auth.Subject.toString() throws NPE
  • IJ02284 JIT Compiler: Division by zero in JIT compiler
  • Make it possible to run Java jnlp files from Firefox. (bsc#1057460)

This update for java-1_7_0-ibm provides the following fixes:

The version was updated to 7.0.10.20 [bsc#1082810]:

• Following security issues were fixed:

  • CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

• Defect fixes:

  • IJ04281 Class Libraries: Startup time increase after applying apar IV96905

  • IJ03822 Class Libraries: Update timezone information to tzdata2017c

  • IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default

  • IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms

  • IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01

  • IJ04282 Security: Change in location and default of jurisdiction policy files

  • IJ03853 Security: IBMCAC provider does not support SHA224

  • IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally

  • IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally

  • IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute

  • IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception

  • IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman

  • IJ02284 JIT Compiler: Division by zero in JIT compiler

  • Make it possible to run Java jnlp files from Firefox. (bsc#1057460)

This update for java-1_7_0-openjdk fixes the following issues:

Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366):

• CVE-2018-2579: Improve key keying case
• CVE-2018-2588: Improve LDAP logins
• CVE-2018-2599: Improve reliability of DNS lookups
• CVE-2018-2602: Improve usage messages
• CVE-2018-2603: Improve PKCS usage
• CVE-2018-2618: Stricter key generation
• CVE-2018-2629: Improve GSS handling
• CVE-2018-2633: Improve LDAP lookup robustness
• CVE-2018-2634: Improve property negotiations
• CVE-2018-2637: Improve JMX supportive features
• CVE-2018-2641: Improve GTK initialization
• CVE-2018-2663: More refactoring for deserialization cases
• CVE-2018-2677: More refactoring for client deserialization cases
• CVE-2018-2678: More refactoring for naming

This update for java-1_8_0-openjdk fixes the following issues:

Security issues fix in jdk8u161 (icedtea 3.7.0)(bsc#1076366):

• CVE-2018-2579: Improve key keying case
• CVE-2018-2582: Better interface invocations
• CVE-2018-2588: Improve LDAP logins
• CVE-2018-2599: Improve reliability of DNS lookups
• CVE-2018-2602: Improve usage messages
• CVE-2018-2603: Improve PKCS usage
• CVE-2018-2618: Stricter key generation
• CVE-2018-2629: Improve GSS handling
• CVE-2018-2633: Improve LDAP lookup robustness
• CVE-2018-2634: Improve property negotiations
• CVE-2018-2637: Improve JMX supportive features
• CVE-2018-2641: Improve GTK initialization
• CVE-2018-2663: More refactoring for deserialization cases
• CVE-2018-2677: More refactoring for client deserialization cases
• CVE-2018-2678: More refactoring for naming deserialization cases

This update for java-1_8_0-ibm fixes the following issues:

• Removed java-1_8_0-ibm-alsa and java-1_8_0-ibm-plugin entries in baselibs.conf due to errors in osc source_validator

Version update to 8.0.5.10 [bsc#1082810]

• Security fixes:

  CVE-2018-2639 CVE-2018-2638 CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

• Defect fixes:

  • IJ02608 Class Libraries: Change of namespace definitions with handlers that implement javax.xml.ws.handler.soap.soaphandler
  • IJ04280 Class Libraries: Deploy Upgrade to Oracle level 8u161-b12
  • IJ03390 Class Libraries: JCL Upgrade to Oracle level 8u161-b12
  • IJ04001 Class Libraries: Performance improvement with child process on AIX
  • IJ04281 Class Libraries: Startup time increase after applying apar IV96905
  • IJ03822 Class Libraries: Update timezone information to tzdata2017c
  • IJ03440 Java Virtual Machine: Assertion failure during class creation
  • IJ03717 Java Virtual Machine: Assertion for gencon with concurrent scavenger on ZOS64
  • IJ03513 Java Virtual Machine: Assertion in concurrent scavenger if initial heap memory size -Xms is set too low
  • IJ03994 Java Virtual Machine: Class.getmethods() does not return all methods
  • IJ03413 Java Virtual Machine: Hang creating thread after redefining classes
  • IJ03852 Java Virtual Machine: ICH408I message when groupaccess is specified with -xshareclasses
  • IJ03716 Java Virtual Machine: java/lang/linkageerror from sun/misc/unsafe.definean onymousclass()
  • IJ03116 Java Virtual Machine: java.fullversion string contains an extra space
  • IJ03347 Java Virtual Machine: java.lang.IllegalStateException in related class MemoryMXBean
  • IJ03878 Java Virtual Machine: java.lang.StackOverflowError is thrown when custom security manager in place
  • IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default
  • IJ04248 JIT Compiler: ArrayIndexOutOfBoundsException is thrown when converting BigDecimal to String
  • IJ04250 JIT Compiler: Assertion failure with concurrentScavenge on Z14
  • IJ03606 JIT Compiler: Java crashes with -version
  • IJ04251 JIT Compiler: JIT compiled method that takes advantage of AutoSIMD produces an incorrect result on x86
  • IJ03854 JIT Compiler: JVM info message appears in stdout
  • IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms
  • IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01
  • IJ03715 Security: Add additional support for the IBMJCEPlus provider, add support for new IBMJCEPlusFIPS provider
  • IJ03800 Security: A fix in CMS provider for KDB integrity
  • IJ04282 Security: Change in location and default of jurisdiction policy files
  • IJ03853 Security: IBMCAC provider does not support SHA224
  • IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally
  • IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally
  • IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute
  • IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception
  • IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman
  • IJ03256 Security: javax.security.auth.Subject.toString() throws NPE
  • PI93233 z/OS Extentions: Cipher.doFinal() fails when using AES/GCM/nopadding with AAD data of 13 bytes and a block size of…

This update for java-1_7_1-ibm fixes the following issues:

The version was updated to 7.1.4.20 [bsc#1082810]

• Security fixes:

  • CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

• Defect fixes:

  • IJ04281 Class Libraries: Startup time increase after applying apar IV96905
  • IJ03822 Class Libraries: Update timezone information to tzdata2017c
  • IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default
  • IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms
  • IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01
  • IJ04282 Security: Change in location and default of jurisdiction policy files
  • IJ03853 Security: IBMCAC provider does not support SHA224
  • IJ02679 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally
  • IJ02706 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally
  • IJ03552 Security: IBMPKCS11Impl -- Config file problem with the slot specification attribute
  • IJ01901 Security: IBMPKCS11Impl -- SecureRandom.setSeed() exception
  • IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman
  • IJ03256 Security: javax.security.auth.Subject.toString() throws NPE
  • IJ02284 JIT Compiler: Division by zero in JIT compiler

• SUSE fixes:

  • Make it possible to run Java jnlp files from Firefox. (bsc#1057460)

  • Fixed symlinks to policy files on update [bsc#1085018]

  • Fixed jpackage-java-1_7_1-ibm-webstart.desktop file to allow Java jnlp files run from Firefox. [bsc#1057460, bsc#1076390]

  • Fix javaws segfaults when java expiration timer has elapsed. [bsc#929900]

  • Provide IBM Java updates for IBMs PMR 55931,671,760 and for SUSEs SR 110991601735. [bsc#966304]

This update for java-1_7_1-ibm fixes the following issue:

The version was updated to 7.1.4.20 [bsc#1082810]

• Security fixes:

  • CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579

• Defect fixes:

  • IJ04281 Class Libraries: Startup time increase after applying apar IV96905
  • IJ03822 Class Libraries: Update timezone information to tzdata2017c
  • IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default
  • IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms
  • IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01
  • IJ04282 Security: Change in location and default of jurisdiction policy files
  • IJ03853 Security: IBMCAC provider does not support SHA224
  • IJ02679 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally
  • IJ02706 Security: IBMPKCS11Impl -- Bad sessions are being allocated internally
  • IJ03552 Security: IBMPKCS11Impl -- Config file problem with the slot specification attribute
  • IJ01901 Security: IBMPKCS11Impl -- SecureRandom.setSeed() exception
  • IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman
  • IJ03256 Security: javax.security.auth.Subject.toString() throws NPE
  • IJ02284 JIT Compiler: Division by zero in JIT compiler

• SUSE fixes:

  • Make it possible to run Java jnlp files from Firefox. (bsc#1057460)

  • Fixed jpackage-java-1_7_1-ibm-webstart.desktop file to allow Java jnlp files run from Firefox. [bsc#1057460, bsc#1076390]

  • Fix javaws segfaults when java expiration timer has elapsed. [bsc#929900]

  • Provide IBM Java updates for IBMs PMR 55931,671,760 and for SUSEs SR 110991601735. [bsc#966304]

  • Ensure that all Java policy files are symlinked into the proper file system locations. Without those symlinks, several OES iManager plugins did not function properly. [bsc#1085018]

It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. (CVE-2018-2579)

It was discovered that the Hotspot component of OpenJDK did not properly validate uses of the invokeinterface JVM instruction. An attacker could possibly use this to access unauthorized resources. (CVE-2018-2582)

It was discovered that the LDAP implementation in OpenJDK did not properly encode login names. A remote attacker could possibly use this to expose sensitive information. (CVE-2018-2588)

It was discovered that the DNS client implementation in OpenJDK did not properly randomize source ports. A remote attacker could use this to spoof responses to DNS queries made by Java applications. (CVE-2018-2599)

It was discovered that the Internationalization component of OpenJDK did not restrict search paths when loading resource bundle classes. A local attacker could use this to trick a user into running malicious code. (CVE-2018-2602)

It was discovered that OpenJDK did not properly restrict memory allocations when parsing DER input. A remote attacker could possibly use this to cause a denial of service. (CVE-2018-2603)

It was discovered that the Java Cryptography Extension (JCE) implementation in OpenJDK in some situations did not guarantee sufficient strength of keys during key agreement. An attacker could use this to expose sensitive information. (CVE-2018-2618)

It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly handle GSS contexts in the native GSS library. An attacker could possibly use this to access unauthorized resources. (CVE-2018-2629)

It was discovered that the LDAP implementation in OpenJDK did not properly handle LDAP referrals in some situations. An attacker could possibly use this to expose sensitive information or gain unauthorized privileges. (CVE-2018-2633)

It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly apply subject credentials. An attacker could possibly use this to expose sensitive information or gain access to unauthorized resources. (CVE-2018-2634)

It was discovered that the Java Management Extensions (JMX) component of OpenJDK did not properly apply deserialization filters in some situations. An attacker could use this to bypass deserialization restrictions. (CVE-2018-2637)

It was discovered that a use-after-free vulnerability existed in the AWT component of OpenJDK when loading the GTK library. An attacker could possibly use this to execute arbitrary code and escape Java sandbox restrictions. (CVE-2018-2641)

It was discovered that in some situations OpenJDK did not properly validate objects when performing deserialization. An attacker could use this to cause a denial of service (application crash or excessive memory consumption). (CVE-2018-2663)

It was discovered that the AWT component of OpenJDK did not properly restrict the amount of memory allocated when deserializing some objects. An attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2018-2677)

It was discovered that the JNDI component of OpenJDK did not properly restrict the amount of memory allocated when deserializing objects in some situations. An attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2018-2678)

It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. (CVE-2018-2579)

It was discovered that the LDAP implementation in OpenJDK did not properly encode login names. A remote attacker could possibly use this to expose sensitive information. (CVE-2018-2588)

It was discovered that the DNS client implementation in OpenJDK did not properly randomize source ports. A remote attacker could use this to spoof responses to DNS queries made by Java applications. (CVE-2018-2599)

It was discovered that the Internationalization component of OpenJDK did not restrict search paths when loading resource bundle classes. A local attacker could use this to trick a user into running malicious code. (CVE-2018-2602)

It was discovered that OpenJDK did not properly restrict memory allocations when parsing DER input. A remote attacker could possibly use this to cause a denial of service. (CVE-2018-2603)

It was discovered that the Java Cryptography Extension (JCE) implementation in OpenJDK in some situations did not guarantee sufficient strength of keys during key agreement. An attacker could use this to expose sensitive information. (CVE-2018-2618)

It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly handle GSS contexts in the native GSS library. An attacker could possibly use this to access unauthorized resources. (CVE-2018-2629)

It was discovered that the LDAP implementation in OpenJDK did not properly handle LDAP referrals in some situations. An attacker could possibly use this to expose sensitive information or gain unauthorized privileges. (CVE-2018-2633)

It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly apply subject credentials. An attacker could possibly use this to expose sensitive information or gain access to unauthorized resources. (CVE-2018-2634)

It was discovered that the Java Management Extensions (JMX) component of OpenJDK did not properly apply deserialization filters in some situations. An attacker could use this to bypass deserialization restrictions. (CVE-2018-2637)

It was discovered that a use-after-free vulnerability existed in the AWT component of OpenJDK when loading the GTK library. An attacker could possibly use this to execute arbitrary code and escape Java sandbox restrictions. (CVE-2018-2641)

It was discovered that in some situations OpenJDK did not properly validate objects when performing deserialization. An attacker could use this to cause a denial of service (application crash or excessive memory consumption). (CVE-2018-2663)

It was discovered that the AWT component of OpenJDK did not properly restrict the amount of memory allocated when deserializing some objects. An attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2018-2677)

It was discovered that the JNDI component of OpenJDK did not properly restrict the amount of memory allocated when deserializing objects in some situations. An attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2018-2678)