{"id":"CVE-2019-2977","aliases":["ALPINE-CVE-2019-2977","DEBIAN-CVE-2019-2977","DSA-4546-1","EUVD-2019-12616","GHSA-37wc-j2j9-6vmf","RHSA-2019:3127","RHSA-2019:3135","SUSE-SU-2019:2998-1","SUSE-SU-2019:3083-1","UBUNTU-CVE-2019-2977","USN-4223-1","openSUSE-SU-2019:2557-1","openSUSE-SU-2019:2565-1","openSUSE-SU-2024:10871-1","openSUSE-SU-2024:10872-1"],"status":"published","title":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions...","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02611,"percentile":0.85516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-10-16T17:40:57Z","modified":"2026-11-03T06:32:35Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openjdk11","fixed_in":["11.0.5_p10-r0"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"openjdk-11","fixed_in":["11.0.5+10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","fixed_in":["11.0.5+10-0ubuntu1.1~18.04"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openjdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5_p10-r0"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"openjdk-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5+10-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"openjdk-11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5+10-1~deb10u1"}]}],"versions":["11.0.3+7-5","11.0.4+1-1","11.0.4+10-1","11.0.4+11-1","11.0.4+11-1~bpo9+1","11.0.4+11-1~deb10u1","11.0.4+2-1","11.0.4+4+really11.0.3+7-1","11.0.4+4+really11.0.3+7-2","11.0.4+4-1","11.0.4+6-1","11.0.4+8-1","11.0.4+9-1","11.0.5+10-1~bpo9+1","11.0.5+6-1","11.0.5+6-2","11.0.5+9-1"],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-demo-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-devel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-headless-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-javadoc-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-javadoc-zip-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-jmods-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"java-11-openjdk-src-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-demo-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-devel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-headless-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-javadoc-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-javadoc-zip-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-jmods-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"java-11-openjdk-src-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-demo-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-devel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-headless-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-javadoc-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-javadoc-zip-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-jmods-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"java-11-openjdk-src-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-demo-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-devel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-headless-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-javadoc-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-javadoc-zip-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-jmods-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"java-11-openjdk-src-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el7_7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-devel-slowdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-headless-slowdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-jmods","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-slowdebug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"java-11-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.5.10-0.el8_0"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5.0-3.36.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5.0-3.36.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5.0-3.3.3"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5.0-3.3.3"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5+10-0ubuntu1.1~18.04"}]}],"versions":["9.0.4+12-2ubuntu4","9.0.4+12-4ubuntu1","10~46-4ubuntu1","10~46-5ubuntu1","10.0.1+10-1ubuntu2","10.0.1+10-3ubuntu1","10.0.2+13-1ubuntu0.18.04.1","10.0.2+13-1ubuntu0.18.04.2","10.0.2+13-1ubuntu0.18.04.3","10.0.2+13-1ubuntu0.18.04.4","11.0.2+9-3ubuntu1~18.04.3","11.0.3+7-1ubuntu2~18.04.1","11.0.4+11-1ubuntu2~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13+33-1","13.0.1+9-2","13.0.2+8-1","13.0.2+8-2","13.0.3+3-1ubuntu2","13.0.4+8-1~20.04","13.0.7+5-0ubuntu1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u232-b09-0ubuntu1~16.04.1"}]}],"versions":["8u66-b01-5","8u72-b05-1ubuntu1","8u72-b05-5","8u72-b05-6","8u72-b15-1","8u72-b15-2ubuntu1","8u72-b15-2ubuntu3","8u72-b15-3ubuntu1","8u77-b03-1ubuntu2","8u77-b03-3ubuntu1","8u77-b03-3ubuntu2","8u77-b03-3ubuntu3","8u91-b14-0ubuntu4~16.04.1","8u91-b14-3ubuntu1~16.04.1","8u111-b14-2ubuntu0.16.04.2","8u121-b13-0ubuntu1.16.04.2","8u131-b11-0ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.2","8u131-b11-2ubuntu1.16.04.3","8u151-b12-0ubuntu0.16.04.2","8u162-b12-0ubuntu0.16.04.2","8u171-b11-0ubuntu0.16.04.1","8u181-b13-0ubuntu0.16.04.1","8u181-b13-1ubuntu0.16.04.1","8u191-b12-0ubuntu0.16.04.1","8u191-b12-2ubuntu0.16.04.1","8u212-b03-0ubuntu1.16.04.1","8u222-b10-1ubuntu1~16.04.1"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5+10-0ubuntu1.1~18.04"}]}],"versions":["9.0.4+12-2ubuntu4","9.0.4+12-4ubuntu1","10~46-4ubuntu1","10~46-5ubuntu1","10.0.1+10-1ubuntu2","10.0.1+10-3ubuntu1","10.0.2+13-1ubuntu0.18.04.1","10.0.2+13-1ubuntu0.18.04.2","10.0.2+13-1ubuntu0.18.04.3","10.0.2+13-1ubuntu0.18.04.4","11.0.2+9-3ubuntu1~18.04.3","11.0.3+7-1ubuntu2~18.04.1","11.0.4+11-1ubuntu2~18.04.3"],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5.0-lp150.2.28.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.5.0-lp151.3.9.2"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-11-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.12.0-3.1"}]}],"bundled":95},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-13-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8.0-3.1"}]}],"bundled":95}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_storage_manager"},{"vendor":"netapp","product":"e-series_santricity_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_web_services_proxy"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"oracle","product":"jdk"},{"vendor":"oracle","product":"jre"},{"vendor":"oracle corporation","product":"java"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3135","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20191017-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4546","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Oct/31","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00066.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4223-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2977","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-37wc-j2j9-6vmf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-2977","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-2977","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3127","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761006","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761601","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3127.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2945","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2949","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2949","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2962","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2964","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2964","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2973","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2973","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2975","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2975","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2977","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2978","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2983","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2983","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2987","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2987","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2988","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2988","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2989","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2992","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2992","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-2999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-2999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2999","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3135.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192998-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152856","tags":["report"]},{"url":"https://bugzilla.suse.com/1154212","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2999","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193083-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-2977","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4223-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-2894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2999","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WCIMAT2F4HXIE6ZIVQQAFTNF3WZ5QK2Y/#WCIMAT2F4HXIE6ZIVQQAFTNF3WZ5QK2Y","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7UPD3ISREA7GUESZ6NQVU7DWRQ66OGDW/#7UPD3ISREA7GUESZ6NQVU7DWRQ66OGDW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2388","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-2977","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T17:40:57Z","modified":"2024-10-01T16:26:37.986Z","updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-12616","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T17:40:57Z","modified":"2024-10-01T16:26:37Z","updated_at":"2026-11-03T00:28:00.970899Z"}],"ghsa":[{"id":"GHSA-37wc-j2j9-6vmf","title":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions...","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2022-05-24T16:59:07Z","modified":"2023-01-28T05:07:37Z","updated_at":"2026-11-02T14:44:33.090384Z"}],"nvd":[{"id":"CVE-2019-2977","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T18:15:32.293Z","modified":"2026-06-17T02:34:58.043Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"ALPINE-CVE-2019-2977","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T18:15:32.293Z","modified":"2026-11-03T06:32:35.140866075Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2019-2977","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T18:15:32.293Z","modified":"2026-03-15T22:31:33.313104Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-2977","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T18:15:32.293Z","modified":"2026-08-29T07:02:32.914064769Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2019:3127","title":"Red Hat Security Advisory: java-11-openjdk security update","status":"published","published":"2024-09-16T02:59:26Z","modified":"2026-06-29T10:27:00Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3135","title":"Red Hat Security Advisory: java-11-openjdk security update","status":"published","published":"2024-09-16T02:59:34Z","modified":"2026-06-29T10:27:02Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-2977","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).","status":"published","published":"2019-10-16T18:15:00Z","modified":"2026-02-04T04:17:41.074418Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DSA-4546-1","title":"openjdk-11 - security update","status":"published","published":"2019-10-20T00:00:00Z","modified":"2026-03-09T02:10:04.826747Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:2557-1","title":"Security update for java-11-openjdk","description":"This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues:\n\nSecurity issues fixed (October 2019 CPU  bsc#1154212):\t  \n\n- CVE-2019-2933: Windows file handling redux\n- CVE-2019-2945: Better socket support\n- CVE-2019-2949: Better Kerberos ccache handling\n- CVE-2019-2958: Build Better Processes\n- CVE-2019-2964: Better support for patterns\n- CVE-2019-2962: Better Glyph Images\n- CVE-2019-2973: Better pattern compilation\n- CVE-2019-2975: Unexpected exception in jjs\n- CVE-2019-2978: Improved handling of jar files\n- CVE-2019-2977: Improve String index handling\n- CVE-2019-2981: Better Path supports\n- CVE-2019-2983: Better serial attributes\n- CVE-2019-2987: Better rendering of native glyphs\n- CVE-2019-2988: Better Graphics2D drawing\n- CVE-2019-2989: Improve TLS connection support\n- CVE-2019-2992: Enhance font glyph mapping\n- CVE-2019-2999: Commentary on Javadoc comments\n- CVE-2019-2894: Enhance ECDSA operations (bsc#1152856).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-23T23:22:03Z","modified":"2026-02-04T02:56:33.315028Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2565-1","title":"Security update for java-11-openjdk","description":"This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues:\n\nSecurity issues fixed (October 2019 CPU  bsc#1154212):\t  \n\n- CVE-2019-2933: Windows file handling redux\n- CVE-2019-2945: Better socket support\n- CVE-2019-2949: Better Kerberos ccache handling\n- CVE-2019-2958: Build Better Processes\n- CVE-2019-2964: Better support for patterns\n- CVE-2019-2962: Better Glyph Images\n- CVE-2019-2973: Better pattern compilation\n- CVE-2019-2975: Unexpected exception in jjs\n- CVE-2019-2978: Improved handling of jar files\n- CVE-2019-2977: Improve String index handling\n- CVE-2019-2981: Better Path supports\n- CVE-2019-2983: Better serial attributes\n- CVE-2019-2987: Better rendering of native glyphs\n- CVE-2019-2988: Better Graphics2D drawing\n- CVE-2019-2989: Improve TLS connection support\n- CVE-2019-2992: Enhance font glyph mapping\n- CVE-2019-2999: Commentary on Javadoc comments\n- CVE-2019-2894: Enhance ECDSA operations (bsc#1152856).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-25T13:29:16Z","modified":"2026-02-04T02:47:54.137762Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10871-1","title":"java-11-openjdk-11.0.12.0-3.1 on GA media","description":"These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:19.394894Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:10872-1","title":"java-13-openjdk-13.0.8.0-3.1 on GA media","description":"These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:55.885522Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:2998-1","title":"Security update for java-11-openjdk","description":"This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues:\n\nSecurity issues fixed (October 2019 CPU  bsc#1154212):\t  \n\n- CVE-2019-2933: Windows file handling redux\n- CVE-2019-2945: Better socket support\n- CVE-2019-2949: Better Kerberos ccache handling\n- CVE-2019-2958: Build Better Processes\n- CVE-2019-2964: Better support for patterns\n- CVE-2019-2962: Better Glyph Images\n- CVE-2019-2973: Better pattern compilation\n- CVE-2019-2975: Unexpected exception in jjs\n- CVE-2019-2978: Improved handling of jar files\n- CVE-2019-2977: Improve String index handling\n- CVE-2019-2981: Better Path supports\n- CVE-2019-2983: Better serial attributes\n- CVE-2019-2987: Better rendering of native glyphs\n- CVE-2019-2988: Better Graphics2D drawing\n- CVE-2019-2989: Improve TLS connection support\n- CVE-2019-2992: Enhance font glyph mapping\n- CVE-2019-2999: Commentary on Javadoc comments\n- CVE-2019-2894: Enhance ECDSA operations (bsc#1152856).\n","status":"published","published":"2019-11-18T14:17:26Z","modified":"2026-02-04T02:39:04.169534Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3083-1","title":"Security update for java-11-openjdk","description":"This update for java-11-openjdk fixes the following issues:\n\nSecurity issues fixed (October 2019 CPU  bsc#1154212):\t  \n\n- CVE-2019-2933: Windows file handling redux\n- CVE-2019-2945: Better socket support\n- CVE-2019-2949: Better Kerberos ccache handling\n- CVE-2019-2958: Build Better Processes\n- CVE-2019-2964: Better support for patterns\n- CVE-2019-2962: Better Glyph Images\n- CVE-2019-2973: Better pattern compilation\n- CVE-2019-2975: Unexpected exception in jjs\n- CVE-2019-2978: Improved handling of jar files\n- CVE-2019-2977: Improve String index handling\n- CVE-2019-2981: Better Path supports\n- CVE-2019-2983: Better serial attributes\n- CVE-2019-2987: Better rendering of native glyphs\n- CVE-2019-2988: Better Graphics2D drawing\n- CVE-2019-2989: Improve TLS connection support\n- CVE-2019-2992: Enhance font glyph mapping\n- CVE-2019-2999: Commentary on Javadoc comments\n- CVE-2019-2894: Enhance ECDSA operations (bsc#1152856).\t  \n","status":"published","published":"2019-11-27T12:20:37Z","modified":"2026-02-04T02:13:51.943381Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4223-1","title":"openjdk-8, openjdk-lts vulnerabilities","description":"Jan Jancar, Petr Svenda, and Vladimir Sedlacek discovered that a side-\nchannel vulnerability existed in the ECDSA implementation in OpenJDK. An\nAttacker could use this to expose sensitive information. (CVE-2019-2894)\n\nIt was discovered that the Socket implementation in OpenJDK did not\nproperly restrict the creation of subclasses with a custom Socket\nimplementation. An attacker could use this to specially create a Java class\nthat could possibly bypass Java sandbox restrictions. (CVE-2019-2945)\n\nRob Hamm discovered that the Kerberos implementation in OpenJDK did not\nproperly handle proxy credentials. An attacker could possibly use this to\nimpersonate another user. (CVE-2019-2949)\n\nIt was discovered that a NULL pointer dereference existed in the font\nhandling implementation in OpenJDK. An attacker could use this to cause a\ndenial of service (application crash). (CVE-2019-2962)\n\nIt was discovered that the Concurrency subsystem in OpenJDK did not\nproperly bound stack consumption when compiling regular expressions. An\nattacker could use this to cause a denial of service (application crash).\n(CVE-2019-2964)\n\nIt was discovered that the JAXP subsystem in OpenJDK did not properly\nhandle XPath expressions in some situations. An attacker could use this to\ncause a denial of service (application crash). (CVE-2019-2973,\nCVE-2019-2981)\n\nIt was discovered that the Nashorn JavaScript subcomponent in OpenJDK did\nnot properly handle regular expressions in some situations. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2019-2975)\n\nIt was discovered that the String class in OpenJDK contained an out-of-\nbounds access vulnerability. An attacker could use this to cause a denial\nof service (application crash) or possibly expose sensitive information.\nThis issue only affected OpenJDK 11 in Ubuntu 18.04 LTS, Ubuntu 19.04,\nand Ubuntu 19.10. (CVE-2019-2977)\n\nIt was discovered that the Jar URL handler in OpenJDK did not properly\nhandled nested Jar URLs in some situations. An attacker could use this to\ncause a denial of service (application crash). (CVE-2019-2978)\n\nIt was discovered that the Serialization component of OpenJDK did not\nproperly handle deserialization of certain object attributes. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2019-2983)\n\nIt was discovered that the FreetypeFontScaler class in OpenJDK did not\nproperly validate dimensions of glyph bitmap images read from font files.\nAn attacker could specially craft a font file that could cause a denial of\nservice (application crash). (CVE-2019-2987)\n\nIt was discovered that a buffer overflow existed in the SunGraphics2D class\nin OpenJDK. An attacker could possibly use this to cause a denial of\nservice (excessive memory consumption or application crash).\n(CVE-2019-2988)\n\nIt was discovered that the Networking component in OpenJDK did not properly\nhandle certain responses from HTTP proxies. An attacker controlling a\nmalicious HTTP proxy could possibly use this to inject content into a\nproxied HTTP connection. (CVE-2019-2989)\n\nIt was discovered that the font handling implementation in OpenJDK did not\nproperly validate TrueType font files in some situations. An attacker could\nspecially craft a font file that could cause a denial of service (excessive\nmemory consumption). (CVE-2019-2992)\n\nIt was discovered that the JavaDoc generator in OpenJDK did not properly\nfilter out some HTML elements properly, including documentation comments in\nJava source code. An attacker could possibly use this to craft a Cross-Site\nScripting attack. (CVE-2019-2999)\n","status":"published","published":"2019-12-17T23:14:32Z","modified":"2026-02-10T04:41:43Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}