{"id":"CVE-2019-2697","aliases":["EUVD-2019-12336","GHSA-rpf9-c8x3-2pp3","RHSA-2019:1163","RHSA-2019:1164","RHSA-2019:1165","RHSA-2019:1166","RHSA-2019:1238","RHSA-2019:1325","SUSE-SU-2019:1308-1","SUSE-SU-2019:1308-2","SUSE-SU-2019:1345-1","SUSE-SU-2019:14059-1","SUSE-SU-2019:1644-1","UBUNTU-CVE-2019-2697","USN-3975-1"],"status":"published","title":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions...","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11466,"percentile":0.96042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2019-04-23T00:00:00Z","modified":"2026-10-16T10:01:17Z","exploits":[{"source":"exploitdb","id":"EDB-46722","title":"Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in sc_FindExtrema4","type":"dos","platform":"multiple","date":"2019-04-17","verified":true,"url":"https://www.exploit-db.com/exploits/46722"}],"fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-8","fixed_in":["8u212-b03-0ubuntu1.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-8","fixed_in":["8u212-b03-0ubuntu1.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.45-1jpp.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.8::el6","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.5.35-1jpp.1.el6_10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-38.37.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.45-26.40.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr5.35-30.50.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u212-b03-0ubuntu1.16.04.1"}]}],"versions":["8u66-b01-5","8u72-b05-1ubuntu1","8u72-b05-5","8u72-b05-6","8u72-b15-1","8u72-b15-2ubuntu1","8u72-b15-2ubuntu3","8u72-b15-3ubuntu1","8u77-b03-1ubuntu2","8u77-b03-3ubuntu1","8u77-b03-3ubuntu2","8u77-b03-3ubuntu3","8u91-b14-0ubuntu4~16.04.1","8u91-b14-3ubuntu1~16.04.1","8u111-b14-2ubuntu0.16.04.2","8u121-b13-0ubuntu1.16.04.2","8u131-b11-0ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.3","8u151-b12-0ubuntu0.16.04.2","8u162-b12-0ubuntu0.16.04.2","8u171-b11-0ubuntu0.16.04.1","8u181-b13-0ubuntu0.16.04.1","8u181-b13-1ubuntu0.16.04.1","8u191-b12-0ubuntu0.16.04.1","8u191-b12-2ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u212-b03-0ubuntu1.18.04.1"}]}],"versions":["8u144-b01-2","8u151-b12-1","8u162-b12-1","8u171-b11-0ubuntu0.18.04.1","8u181-b13-0ubuntu0.18.04.1","8u181-b13-1ubuntu0.18.04.1","8u191-b12-0ubuntu0.18.04.1","8u191-b12-2ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u212-b03-0ubuntu1.16.04.1"}]}],"versions":["8u66-b01-5","8u72-b05-1ubuntu1","8u72-b05-5","8u72-b05-6","8u72-b15-1","8u72-b15-2ubuntu1","8u72-b15-2ubuntu3","8u72-b15-3ubuntu1","8u77-b03-1ubuntu2","8u77-b03-3ubuntu1","8u77-b03-3ubuntu2","8u77-b03-3ubuntu3","8u91-b14-0ubuntu4~16.04.1","8u91-b14-3ubuntu1~16.04.1","8u111-b14-2ubuntu0.16.04.2","8u121-b13-0ubuntu1.16.04.2","8u131-b11-0ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.3","8u151-b12-0ubuntu0.16.04.2","8u162-b12-0ubuntu0.16.04.2","8u171-b11-0ubuntu0.16.04.1","8u181-b13-0ubuntu0.16.04.1","8u181-b13-1ubuntu0.16.04.1","8u191-b12-0ubuntu0.16.04.1","8u191-b12-2ubuntu0.16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.3+7-1ubuntu2~18.04.1"}]}],"versions":["9.0.4+12-2ubuntu4","9.0.4+12-4ubuntu1","10~46-4ubuntu1","10~46-5ubuntu1","10.0.1+10-1ubuntu2","10.0.1+10-3ubuntu1","10.0.2+13-1ubuntu0.18.04.1","10.0.2+13-1ubuntu0.18.04.2","10.0.2+13-1ubuntu0.18.04.3","10.0.2+13-1ubuntu0.18.04.4","11.0.2+9-3ubuntu1~18.04.3"],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"hp","product":"xp7_command_view"},{"vendor":"oracle","product":"jdk"},{"vendor":"oracle","product":"jre"},{"vendor":"oracle corporation","product":"java"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"satellite"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://usn.ubuntu.com/3975-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1164","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1163","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1165","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1166","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1238","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1325","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201908-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03959en_us","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2697","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rpf9-c8x3-2pp3"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1704480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1704799","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1163.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2602","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2602","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2684","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2697","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2697","tags":["advisory","report"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html#AppendixJAVA","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2698","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10245","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1164.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1165.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1166.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685717","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1238.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11212","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11212","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12547","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12549","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2422","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2449","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2449","tags":["advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixJAVA","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1325.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191308-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1132728","tags":["report"]},{"url":"https://bugzilla.suse.com/1132729","tags":["report"]},{"url":"https://bugzilla.suse.com/1132732","tags":["report"]},{"url":"https://bugzilla.suse.com/1132734","tags":["report"]},{"url":"https://bugzilla.suse.com/1134718","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2698","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191308-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191345-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914059-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191644-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-2697","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3975-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-2602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2698","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2019-04-23T18:16:44Z","modified":"2024-10-02T15:57:35.609Z","updated_at":"2026-11-02T14:20:22.3662Z"}],"euvd":[{"id":"EUVD-2019-12336","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2019-04-23T18:16:44Z","modified":"2024-10-02T15:57:35Z","updated_at":"2026-11-03T00:27:58.042417Z"}],"ghsa":[{"id":"GHSA-rpf9-c8x3-2pp3","title":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions...","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2022-05-24T16:44:27Z","modified":"2023-02-01T05:02:13Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:49:52.298896Z"}],"nvd":[{"id":"CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2019-04-23T19:32:56.193Z","modified":"2026-06-17T02:34:24.203Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"RHSA-2019:1163","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T19:50:30Z","modified":"2026-06-29T10:24:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1164","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T19:50:38Z","modified":"2026-06-29T10:24:24Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1165","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T19:51:16Z","modified":"2026-06-29T10:24:24Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1166","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T19:51:23Z","modified":"2026-06-29T10:24:25Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:1238","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T19:51:35Z","modified":"2026-10-16T10:01:17Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:1325","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T19:51:18Z","modified":"2026-06-29T10:24:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","status":"published","published":"2019-04-23T00:00:00Z","modified":"2026-02-04T02:59:22.689121Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"SUSE-SU-2019:1308-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 5 Fix Pack 35.\n\nSecurity issues fixed:\n\n- CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).\n- CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).\n- CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).\n- CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).\n- CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).\n","status":"published","published":"2019-05-21T16:35:27Z","modified":"2026-02-04T04:29:34.867518Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1308-2","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 5 Fix Pack 35.\n\nSecurity issues fixed:\n\n- CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).\n- CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).\n- CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).\n- CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).\n- CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).\n","status":"published","published":"2019-06-27T09:41:11Z","modified":"2026-02-04T02:57:14.06414Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1345-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\nUpdate to Java 7.1 Service Refresh 4 Fix Pack 45.\n\nSecurity issues fixed:\n\n- CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).\n- CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).\n- CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).\n- CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).\n- CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).\n","status":"published","published":"2019-05-24T12:00:33Z","modified":"2026-02-04T04:24:16.744435Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:14059-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\nUpdate to Java 7.1 Service Refresh 4 Fix Pack 45.\n                                                                                     \nSecurity issues fixed:                                                                   \n                                                                        \n- CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).                                              \n- CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).                                                                   \n- CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).                                                                   \n- CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).                                                                                                                 \n- CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).                                                                                                                            \n","status":"published","published":"2019-07-23T05:31:21Z","modified":"2025-05-02T04:08:35.007206Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1644-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 5 Fix Pack 35.\n\nSecurity issues fixed:\n\n- CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718).\n- CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729).\n- CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734).\n- CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728).\n- CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732).\n","status":"published","published":"2019-06-21T14:10:18Z","modified":"2025-05-02T04:08:35.068111Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3975-1","title":"openjdk-8, openjdk-lts vulnerabilities","description":"It was discovered that the BigDecimal implementation in OpenJDK performed\nexcessive computation when given certain values. An attacker could use this\nto cause a denial of service (excessive CPU usage). (CVE-2019-2602)\n\nCorwin de Boor and Robert Xiao discovered that the RMI registry\nimplementation in OpenJDK did not properly select the correct skeleton\nclass in some situations. An attacker could use this to possibly escape\nJava sandbox restrictions. (CVE-2019-2684)\n\nMateusz Jurczyk discovered a vulnerability in the 2D component of\nOpenJDK. An attacker could use this to possibly escape Java sandbox\nrestrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04\nLTS. (CVE-2019-2697)\n\nMateusz Jurczyk discovered a vulnerability in the font layout engine\nof OpenJDK's 2D component. An attacker could use this to possibly\nescape Java sandbox restrictions. This issue only affected OpenJDK 8\nin Ubuntu 16.04 LTS. (CVE-2019-2698)\n","status":"published","published":"2019-05-13T19:36:19Z","modified":"2026-02-10T04:41:31Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}