Every CVE Search/ Get API key

CVE-2022-21349

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...

5.3 MediumFix available

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

3.31%Up 2.4 points since Feb 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
CVE-2022-21349
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
EUVDEUVD-2022-26574 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
EUVD-2022-26574
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-mv36-g4g7-p396 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
GHSA-mv36-g4g7-p396
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
NVD 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
CVE-2022-21349
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVALPINE-CVE-2022-21349 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
ALPINE-CVE-2022-21349
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSV 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
CVE-2022-21349
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 17 moreShow less
OSVOESA-2022-1786 5.3

openjdk-1.8.0 security update

The OpenJDK runtime environment 8.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21349)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2022-21540)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2022-21541)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include…

Record
OESA-2022-1786
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-21349 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
UBUNTU-CVE-2022-21349
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBIT-java-2022-21349 No score

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
BIT-java-2022-21349
Updated
2026-11-02
OSVBIT-java-min-2022-21349 No score

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
BIT-java-min-2022-21349
Updated
2026-11-02
OSVBIT-jre-2022-21349 No score

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Record
BIT-jre-2022-21349
Updated
2026-11-02
OSVCLSA-2022-1661173656 No score

Fixed 50 CVEs in java-1.7.0-openjdk

  • Bump to 2.6.28 and OpenJDK 7u351-b01.
  • Security fixes in 7u351:
  • CVE-2022-21540: Improve class compilation (JDK-8281859)
  • CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
  • CVE-2022-34169: Improve Xalan supports (JDK-8285407)
  • Security fixes in 7u341:
  • CVE-2022-21426: Better XPath expression handling (JDK-8270504)
  • CVE-2022-21434: Better invocation handler handling (JDK-8277672)
  • CVE-2022-21443: Improved Object Identification (JDK-8275151)
  • CVE-2022-21476: Improve Santuario processing (JDK-8278008)
  • CVE-2022-21496: Improve URL supports (JDK-8278972)
  • Security fixes in 7u331:
  • CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
  • CVE-2022-21282: Better resolution of URIs (JDK-8270492)
  • CVE-2022-21283: Better String matching (JDK-8268813)
  • CVE-2022-21293: Improve String constructions (JDK-8270392)
  • CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
  • CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
  • CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
  • CVE-2022-21305: Better array indexing (JDK-8272014)
  • CVE-2022-21340: Verify Jar Verification (JDK-8272026)
  • CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
  • CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
  • CVE-2022-21360: Enhance BMP image support (JDK-8273756)
  • CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
  • Security fixes in 7u321:
  • CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
  • CVE-2021-35556: Richer Text Editors (JDK-8265167)
  • CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
  • CVE-2021-35561: Better hashing support (JDK-8266097)
  • CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
  • CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
  • CVE-2021-35586: Better BMP support (JDK-8267735)
  • CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
  • CVE-2021-35603: Better session identification (JDK-8269618)
  • Security fixes in 7u311:
  • CVE-2021-2341: Improve file transfers (JDK-8258432)
  • CVE-2021-2369: Better jar file validation (JDK-8260967)
  • CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
  • Security fixes in 7u301:
  • CVE-2021-2161: Less ambiguous processing (JDK-8250568)
  • CVE-2021-2163: Enhance opening JARs (JDK-8249906)
  • Security fixes in 7u281:
  • CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
  • CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
  • CVE-2020-14782: Enhance certificate processing (JDK-8237995)
  • CVE-2020-14792: Better range handling (JDK-8241114)
  • CVE-2020-14796: Improved URI Support (JDK-8242680)
  • CVE-2020-14797: Better Path Validation (JDK-8242685)
  • CVE-2020-14798: Enhanced buffer support (JDK-8242695)
  • CVE-2020-14803: Improved Buffer supports (JDK-8244136)
  • Security fixes in 7u271:
  • CVE-2020-14577: Enhance certificate verification (JDK-8237592)
  • CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
  • CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
  • CVE-2020-14581: Better matrix operations (JDK-8238002)
  • CVE-2020-14583: Better Buffer support (JDK-8238920)
  • CVE-2020-14593: Less Affine Transformations (JDK-8240119)
  • CVE-2020-14621: Better XML namespace handling (JDK-8242136)
  • Update tzdata requirement to 2022a to match JDK-8283350
  • Update NEWS from IcedTea
  • Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version
Record
CLSA-2022-1661173656
Updated
2026-11-02
OSVCLSA-2022-1661176564 No score

Fixed 50 CVEs in java-1.7.0-openjdk

  • Bump to 2.6.28 and OpenJDK 7u351-b01.
  • Security fixes in 7u351:
  • CVE-2022-21540: Improve class compilation (JDK-8281859)
  • CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)
  • CVE-2022-34169: Improve Xalan supports (JDK-8285407)
  • Security fixes in 7u341:
  • CVE-2022-21426: Better XPath expression handling (JDK-8270504)
  • CVE-2022-21434: Better invocation handler handling (JDK-8277672)
  • CVE-2022-21443: Improved Object Identification (JDK-8275151)
  • CVE-2022-21476: Improve Santuario processing (JDK-8278008)
  • CVE-2022-21496: Improve URL supports (JDK-8278972)
  • Security fixes in 7u331:
  • CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)
  • CVE-2022-21282: Better resolution of URIs (JDK-8270492)
  • CVE-2022-21283: Better String matching (JDK-8268813)
  • CVE-2022-21293: Improve String constructions (JDK-8270392)
  • CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)
  • CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)
  • CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)
  • CVE-2022-21305: Better array indexing (JDK-8272014)
  • CVE-2022-21340: Verify Jar Verification (JDK-8272026)
  • CVE-2022-21341: Improve serial forms for transport (JDK-8272236)
  • CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)
  • CVE-2022-21360: Enhance BMP image support (JDK-8273756)
  • CVE-2022-21365: Enhanced BMP processing (JDK-8273838)
  • Security fixes in 7u321:
  • CVE-2021-35550: Update the default enabled cipher suites preference (JDK-8163326)
  • CVE-2021-35556: Richer Text Editors (JDK-8265167)
  • CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)
  • CVE-2021-35561: Better hashing support (JDK-8266097)
  • CVE-2021-35564: Improve Keystore integrity (JDK-8266137)
  • CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close (JDK-8254967)
  • CVE-2021-35586: Better BMP support (JDK-8267735)
  • CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)
  • CVE-2021-35603: Better session identification (JDK-8269618)
  • Security fixes in 7u311:
  • CVE-2021-2341: Improve file transfers (JDK-8258432)
  • CVE-2021-2369: Better jar file validation (JDK-8260967)
  • CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)
  • Security fixes in 7u301:
  • CVE-2021-2161: Less ambiguous processing (JDK-8250568)
  • CVE-2021-2163: Enhance opening JARs (JDK-8249906)
  • Security fixes in 7u281:
  • CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)
  • CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)
  • CVE-2020-14782: Enhance certificate processing (JDK-8237995)
  • CVE-2020-14792: Better range handling (JDK-8241114)
  • CVE-2020-14796: Improved URI Support (JDK-8242680)
  • CVE-2020-14797: Better Path Validation (JDK-8242685)
  • CVE-2020-14798: Enhanced buffer support (JDK-8242695)
  • CVE-2020-14803: Improved Buffer supports (JDK-8244136)
  • Security fixes in 7u271:
  • CVE-2020-14577: Enhance certificate verification (JDK-8237592)
  • CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)
  • CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) (JDK-8028431)
  • CVE-2020-14581: Better matrix operations (JDK-8238002)
  • CVE-2020-14583: Better Buffer support (JDK-8238920)
  • CVE-2020-14593: Less Affine Transformations (JDK-8240119)
  • CVE-2020-14621: Better XML namespace handling (JDK-8242136)
  • Update tzdata requirement to 2022a to match JDK-8283350
  • Update NEWS from IcedTea
  • Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after bump OpenJDK version
Record
CLSA-2022-1661176564
Updated
2026-11-02
OSVopenSUSE-SU-2022:0873-1 No score

Security update for java-1_8_0-openjdk

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u322 (icedtea-3.22.0)

Including the following security fixes:

  • CVE-2022-21248, bsc#1194926: Enhance cross VM serialization
  • CVE-2022-21283, bsc#1194937: Better String matching
  • CVE-2022-21293, bsc#1194935: Improve String constructions
  • CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps
  • CVE-2022-21282, bsc#1194933: Better resolution of URIs
  • CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management
  • CVE-2022-21299, bsc#1194931: Improved scanning of XML entities
  • CVE-2022-21305, bsc#1194939: Better array indexing
  • CVE-2022-21340, bsc#1194940: Verify Jar Verification
  • CVE-2022-21341, bsc#1194941: Improve serial forms for transport
  • CVE-2022-21349: Improve Solaris font rendering
  • CVE-2022-21360, bsc#1194929: Enhance BMP image support
  • CVE-2022-21365, bsc#1194928: Enhanced BMP processing
Record
openSUSE-SU-2022:0873-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:1027-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126).

Including fixes for the following vulnerabilities:

CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271.

Non-securtiy fix:

  • Fixed a broken symlink for javaws (bsc#1195146).
Record
openSUSE-SU-2022:1027-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11895-1 No score

java-1_8_0-openjdk-1.8.0.322-1.1 on GA media

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.322-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11895-1
Updated
2026-11-02
OSVSUSE-SU-2022:0871-1 No score

Security update for java-1_8_0-openjdk

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u322 (icedtea-3.22.0)

Including the following security fixes:

  • CVE-2022-21248, bsc#1194926: Enhance cross VM serialization
  • CVE-2022-21283, bsc#1194937: Better String matching
  • CVE-2022-21293, bsc#1194935: Improve String constructions
  • CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps
  • CVE-2022-21282, bsc#1194933: Better resolution of URIs
  • CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management
  • CVE-2022-21299, bsc#1194931: Improved scanning of XML entities
  • CVE-2022-21305, bsc#1194939: Better array indexing
  • CVE-2022-21340, bsc#1194940: Verify Jar Verification
  • CVE-2022-21341, bsc#1194941: Improve serial forms for transport
  • CVE-2022-21349: Improve Solaris font rendering
  • CVE-2022-21360, bsc#1194929: Enhance BMP image support
  • CVE-2022-21365, bsc#1194928: Enhanced BMP processing
Record
SUSE-SU-2022:0871-1
Updated
2026-11-02
OSVSUSE-SU-2022:0873-1 No score

Security update for java-1_8_0-openjdk

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u322 (icedtea-3.22.0)

Including the following security fixes:

  • CVE-2022-21248, bsc#1194926: Enhance cross VM serialization
  • CVE-2022-21283, bsc#1194937: Better String matching
  • CVE-2022-21293, bsc#1194935: Improve String constructions
  • CVE-2022-21294, bsc#1194934: Enhance construction of Identity maps
  • CVE-2022-21282, bsc#1194933: Better resolution of URIs
  • CVE-2022-21296, bsc#1194932: Improve SAX Parser configuration management
  • CVE-2022-21299, bsc#1194931: Improved scanning of XML entities
  • CVE-2022-21305, bsc#1194939: Better array indexing
  • CVE-2022-21340, bsc#1194940: Verify Jar Verification
  • CVE-2022-21341, bsc#1194941: Improve serial forms for transport
  • CVE-2022-21349: Improve Solaris font rendering
  • CVE-2022-21360, bsc#1194929: Enhance BMP image support
  • CVE-2022-21365, bsc#1194928: Enhanced BMP processing
Record
SUSE-SU-2022:0873-1
Updated
2026-11-02
OSVSUSE-SU-2022:1025-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

Update Java 7.1 to Service Refresh 7 Fix Pack 5 (bsc#1197126).

Including fixes for the following vulnerabilities:

CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271.

Record
SUSE-SU-2022:1025-1
Updated
2026-11-02
OSVSUSE-SU-2022:1026-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126).

Including fixes for the following vulnerabilities:

CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271.

Non-securtiy fix:

  • Fixed a broken symlink for javaws (bsc#1195146).
Record
SUSE-SU-2022:1026-1
Updated
2026-11-02
OSVSUSE-SU-2022:1027-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update Java 8.0 to Service Refresh 7 Fix Pack 5 (bsc#1197126).

Including fixes for the following vulnerabilities:

CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271.

Non-securtiy fix:

  • Fixed a broken symlink for javaws (bsc#1195146).
Record
SUSE-SU-2022:1027-1
Updated
2026-11-02
OSVSUSE-SU-2022:14926-1 No score

Security update for java-1_7_0-ibm

This update for java-1_7_0-ibm fixes the following issues:

Update Java 7.0 to Service Refresh 11 Fix Pack 5 (bsc#1197126).

Including fixes for the following vulnerabilities:

CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271.

Record
SUSE-SU-2022:14926-1
Updated
2026-11-02
OSVSUSE-SU-2022:14927-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

Update Java 7.1 to Service Refresh 7 Fix Pack 5 (bsc#1197126).

Including fixes for the following vulnerabilities:

CVE-2022-21366, CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21277, CVE-2022-21299, CVE-2022-21296, CVE-2022-21282, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21283, CVE-2022-21248, CVE-2022-21271.

Record
SUSE-SU-2022:14927-1
Updated
2026-11-02

Affected products

Show 5 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
openjdk8
Alpine:v3.15
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.16
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.17
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.18
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.19
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.20
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.21
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.22
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.23
 before 8.322.06-r0
8.322.06-r0
openjdk8
Alpine:v3.24
 before 8.322.06-r0
8.322.06-r0
Show 101 moreShow less
Affected packages
PackageAffectedFixed
java
Bitnami
 before 1.7.0, 1.8.0 up to 1.8.0, 1.9.0 up to 7.0.331, 8.0.0 up to 8.0.321
1.7.01.8.07.0.3318.0.321
java-min
Bitnami
 before 1.7.0, 1.8.0 up to 1.8.0, 1.9.0 up to 7.0.331, 8.0.0 up to 8.0.321
1.7.01.8.07.0.3318.0.321
jre
Bitnami
 before 1.7.0, 1.8.0 up to 1.8.0, 1.9.0 up to 7.0.331, 8.0.0 up to 8.0.321
1.7.01.8.07.0.3318.0.321
java-1.7.0-openjdk
TuxCare:OracleLinux:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-demo
TuxCare:OracleLinux:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-devel
TuxCare:OracleLinux:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-javadoc
TuxCare:OracleLinux:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-src
TuxCare:OracleLinux:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk
TuxCare:CentOS:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-demo
TuxCare:CentOS:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-devel
TuxCare:CentOS:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-javadoc
TuxCare:CentOS:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
java-1.7.0-openjdk-src
TuxCare:CentOS:6
 before 1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
1:1.7.0.351-2.6.28.0.el6.tuxcare.els1
openjdk-8
Debian:9
 before 8u322-b06-1~deb9u1, plus listed versions
8u131-b11-28u141-b15-18u141-b15-1~deb9u18u141-b15-28u141-b15-3
Show 45 moreShow less
8u144-b01-18u144-b01-28u151-b12-18u151-b12-1~deb9u18u162-b12-18u162-b12-1~bpo8+18u162-b12-1~deb9u18u171-b11-18u171-b11-1~bpo8+18u171-b11-1~deb9u18u171-b11-28u181-b13-18u181-b13-1~deb9u18u181-b13-28u181-b13-2~deb9u18u191-b12-18u191-b12-28u202-b26-18u202-b26-28u202-b26-38u212-b01-18u212-b01-1~deb9u18u212-b03-18u212-b03-28u212-b03-2~deb9u18u222-b04-18u222-b04-38u222-b05-18u222-b07-18u222-b07-28u222-b07-38u222-b10-18u222-b10-1~deb9u18u232-b04-18u232-b07-18u232-b07-28u232-b09-18u232-b09-1~deb9u18u242-b04-18u242-b08-18u242-b08-1~deb9u18u252-b07-18u252-b09-18u252-b09-1~deb9u18u265-b01-0+deb9u1
8u322-b06-1~deb9u1
openjdk-1.8.0
openEuler:20.03-LTS-SP1
 before java-1.8.0-openjdk-1.8.0.342.b07-0.oe1
java-1.8.0-openjdk-1.8.0.342.b07-0.oe1
openjdk-1.8.0
openEuler:20.03-LTS-SP3
 before java-1.8.0-openjdk-1.8.0.342.b07-0.oe1
java-1.8.0-openjdk-1.8.0.342.b07-0.oe1
openjdk-1.8.0
openEuler:22.03-LTS
 before java-1.8.0-openjdk-1.8.0.342.b07-0.oe2203
java-1.8.0-openjdk-1.8.0.342.b07-0.oe2203
java-1_8_0-openjdk
SUSE:HPE Helion OpenStack 8
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:OpenStack Cloud 8
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:OpenStack Cloud 9
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:OpenStack Cloud Crowbar 8
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:OpenStack Cloud Crowbar 9
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 12 SP5
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.8.0.322-27.72.2
1.8.0.322-27.72.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Module for Legacy 15 SP3
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 15-LTSS
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Manager Proxy 4.1
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Manager Retail Branch Server 4.1
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Manager Server 4.1
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Enterprise Storage 6
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-openjdk
SUSE:Enterprise Storage 7
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_7_1-ibm
SUSE:HPE Helion OpenStack 8
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 8
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 9
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:OpenStack Cloud Crowbar 8
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:OpenStack Cloud Crowbar 9
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP5
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.7.1_sr5.5-38.68.1
1.7.1_sr5.5-38.68.1
java-1_8_0-ibm
SUSE:HPE Helion OpenStack 8
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 8
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 9
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:OpenStack Cloud Crowbar 8
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:OpenStack Cloud Crowbar 9
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP5
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.8.0_sr7.5-30.87.1
1.8.0_sr7.5-30.87.1
java-1_8_0-ibm
SUSE:Linux Enterprise Module for Legacy 15 SP3
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15-LTSS
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Manager Proxy 4.1
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Manager Retail Branch Server 4.1
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Manager Server 4.1
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Enterprise Storage 6
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-ibm
SUSE:Enterprise Storage 7
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_7_0-ibm
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.7.0_sr11.5-65.66.1
1.7.0_sr11.5-65.66.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.7.1_sr5.5-26.71.2
1.7.1_sr5.5-26.71.2
openjdk-8
Ubuntu:Pro:16.04:LTS
 before 8u342-b07-0ubuntu1~16.04, plus listed versions
8u66-b01-58u72-b05-1ubuntu18u72-b05-58u72-b05-68u72-b15-1
Show 32 moreShow less
8u72-b15-2ubuntu18u72-b15-2ubuntu38u72-b15-3ubuntu18u77-b03-1ubuntu28u77-b03-3ubuntu18u77-b03-3ubuntu28u77-b03-3ubuntu38u91-b14-0ubuntu4~16.04.18u91-b14-3ubuntu1~16.04.18u111-b14-2ubuntu0.16.04.28u121-b13-0ubuntu1.16.04.28u131-b11-0ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.38u151-b12-0ubuntu0.16.04.28u162-b12-0ubuntu0.16.04.28u171-b11-0ubuntu0.16.04.18u181-b13-0ubuntu0.16.04.18u181-b13-1ubuntu0.16.04.18u191-b12-0ubuntu0.16.04.18u191-b12-2ubuntu0.16.04.18u212-b03-0ubuntu1.16.04.18u222-b10-1ubuntu1~16.04.18u232-b09-0ubuntu1~16.04.18u242-b08-0ubuntu3~16.048u252-b09-1~16.048u265-b01-0ubuntu2~16.048u272-b10-0ubuntu1~16.048u275-b01-0ubuntu1~16.048u282-b08-0ubuntu1~16.048u292-b10-0ubuntu1~16.04.18u312-b07-0ubuntu1~16.04
8u342-b07-0ubuntu1~16.04
icedtea-web
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.5.2-1ubuntu21.5.3-0ubuntu11.6.1-1ubuntu21.6.1-3ubuntu11.6.1-4ubuntu11.6.2-1ubuntu11.6.2-2ubuntu11.6.2-3ubuntu1
 None known
openjdk-8
Ubuntu:18.04:LTS
 before 8u342-b07-0ubuntu1~18.04, plus listed versions
8u144-b01-28u151-b12-18u162-b12-18u171-b11-0ubuntu0.18.04.18u181-b13-0ubuntu0.18.04.1
Show 14 moreShow less
8u181-b13-1ubuntu0.18.04.18u191-b12-0ubuntu0.18.04.18u191-b12-2ubuntu0.18.04.18u212-b03-0ubuntu1.18.04.18u222-b10-1ubuntu1~18.04.18u232-b09-0ubuntu1~18.04.18u242-b08-0ubuntu3~18.048u252-b09-1~18.048u265-b01-0ubuntu2~18.048u272-b10-0ubuntu1~18.048u275-b01-0ubuntu1~18.048u282-b08-0ubuntu1~18.048u292-b10-0ubuntu1~18.048u312-b07-0ubuntu1~18.04
8u342-b07-0ubuntu1~18.04
icedtea-web
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.6.2-3.1ubuntu31.8-0ubuntu8~18.04
 None known
openjdk-8
Ubuntu:20.04:LTS
 before 8u342-b07-0ubuntu1~20.04, plus listed versions
8u232-b09-0ubuntu18u232-b09-18u242-b04-18u242-b08-0ubuntu38u252-b07-1
Show 7 moreShow less
8u252-b09-1ubuntu18u265-b01-0ubuntu2~20.048u272-b10-0ubuntu1~20.048u275-b01-0ubuntu1~20.048u282-b08-0ubuntu1~20.048u292-b10-0ubuntu1~20.048u312-b07-0ubuntu1~20.04
8u342-b07-0ubuntu1~20.04
icedtea-web
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.8-0ubuntu8
 None known
icedtea-web
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.8.4-1build1
 None known
openjdk-8
Ubuntu:22.04:LTS
 before 8u342-b07-0ubuntu1~22.04, plus listed versions
8u302-b08-0ubuntu28u312-b07-0ubuntu1
8u342-b07-0ubuntu1~22.04
icedtea-web
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.8.8-21.8.8-2ubuntu1
 None known
icedtea-web
Ubuntu:25.10
 All versions, plus listed versions
1.8.8-3
 None known
icedtea-web
Ubuntu:26.10
 All versions, plus listed versions
1.8.8-4
 None known
icedtea-web
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.8.8-31.8.8-3build11.8.8-3ubuntu11.8.8-4
 None known
java-1_8_0-openjdk
openSUSE:Leap 15.3
 before 1.8.0.322-3.64.2
1.8.0.322-3.64.2
java-1_8_0-ibm
openSUSE:Leap 15.3
 before 1.8.0_sr7.5-150000.3.56.1
1.8.0_sr7.5-150000.3.56.1
java-1_8_0-openjdk
openSUSE:Tumbleweed
 before 1.8.0.322-1.1
1.8.0.322-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21349 is a medium vulnerability (CVSS 5.3) in Oracle Graalvm, published January 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.31%, the 88th percentile. Fixed in openjdk8 8.322.06-r0.

References

Show 58 moreShow less
This page doesn't list everything

Left out here: 14 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open