CVE-2019-2602

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The updated packages fix several bugs and some security issues:

Font layout engine out of bounds access setCurrGlyphID(). (CVE-2019-2698)

Slow conversion of BigDecimal to long. (CVE-2019-2602)

Incorrect skeleton selection in RMI registry server-side dispatch handling. (CVE-2019-2684)

This update for java-11-openjdk to version 11.0.3+7 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Fixed excessive use of CPU time in the BigDecimal implementation (bsc#1132728).
• CVE-2019-2684: Fixed a flaw in the RMI registry implementation which could lead to selection of an incorrect skeleton class (bsc#1132732).

Non-security issues fixed:

• Multiple bug fixes and improvements.

This update was imported from the SUSE:SLE-15:Update update project.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-15-openjdk-15.0.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openjdk to version 11.0.3+7 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Fixed excessive use of CPU time in the BigDecimal implementation (bsc#1132728).
• CVE-2019-2684: Fixed a flaw in the RMI registry implementation which could lead to selection of an incorrect skeleton class (bsc#1132732).

Non-security issues fixed:

• Multiple bug fixes and improvements.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2018-3639: fix revision to prefer PR_SPEC_DISABLE_NOEXEC to PR_SPEC_DISABLE

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_8_0-openjdk to version 8u212 fixes the following issues:

Security issues fixed:

• CVE-2019-2602: Better String parsing (bsc#1132728).
• CVE-2019-2684: More dynamic RMI interactions (bsc#1132732).
• CVE-2019-2698: Fuzzing TrueType fonts - setCurrGlyphID() (bsc#1132729).
• CVE-2019-2422: Better FileChannel (bsc#1122293).
• CVE-2018-11212: Improve JPEG (bsc#1122299).

Non-Security issue fixed:

• Disable LTO (bsc#1133135).
• Added Japanese new era name.

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 45.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_7_0-openjdk fixes the following issues:

Update to 2.6.18 - OpenJDK 7u221 (April 2019 CPU)

Security issues fixed:

• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw inside the RMI registry implementation (bsc#1132732).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2422: Fixed memory disclosure in FileChannelImpl (bsc#1122293).
• CVE-2018-11212: Fixed a Divide By Zero in alloc_sarray function in jmemmgr.c (bsc#1122299).
• CVE-2019-2426: Improve web server connections (bsc#1134297).

Bug fixes:

• Please check the package Changelog for detailed information.

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 45.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 35.

Security issues fixed:

• CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).
• CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).
• CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).
• CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).
• CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).

It was discovered that the BigDecimal implementation in OpenJDK performed excessive computation when given certain values. An attacker could use this to cause a denial of service (excessive CPU usage). (CVE-2019-2602)

Corwin de Boor and Robert Xiao discovered that the RMI registry implementation in OpenJDK did not properly select the correct skeleton class in some situations. An attacker could use this to possibly escape Java sandbox restrictions. (CVE-2019-2684)

Mateusz Jurczyk discovered a vulnerability in the 2D component of OpenJDK. An attacker could use this to possibly escape Java sandbox restrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04 LTS. (CVE-2019-2697)

Mateusz Jurczyk discovered a vulnerability in the font layout engine of OpenJDK's 2D component. An attacker could use this to possibly escape Java sandbox restrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04 LTS. (CVE-2019-2698)