{"id":"USN-3747-2","aliases":[],"status":"published","title":"openjdk-lts regression","description":"USN-3747-1 fixed vulnerabilities in OpenJDK 10 for Ubuntu 18.04 LTS.\nUnfortunately, that update introduced a regression around accessability\nsupport that prevented some Java applications from starting.\nThis update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that OpenJDK did not properly validate types in some\n situations. An attacker could use this to construct a Java class that could\n possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826)\n\n It was discovered that the PatternSyntaxException class in OpenJDK did not\n properly validate arguments passed to it. An attacker could use this to\n potentially construct a class that caused a denial of service (excessive\n memory consumption). (CVE-2018-2952)\n\n Daniel Bleichenbacher discovered a vulnerability in the Galois/Counter Mode\n (GCM) mode of operation for symmetric block ciphers in OpenJDK. An attacker\n could use this to expose sensitive information. (CVE-2018-2972)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-09-12T22:13:03Z","modified":"2026-02-10T04:41:23Z","fixes":[{"ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","fixed_in":["10.0.2+13-1ubuntu0.18.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.2+13-1ubuntu0.18.04.2"}]}],"versions":["9.0.4+12-2ubuntu4","9.0.4+12-4ubuntu1","10~46-4ubuntu1","10~46-5ubuntu1","10.0.1+10-1ubuntu2","10.0.1+10-3ubuntu1","10.0.2+13-1ubuntu0.18.04.1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-3747-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1788250","tags":["report"]}],"sources":{"osv":[{"id":"USN-3747-2","title":"openjdk-lts regression","description":"USN-3747-1 fixed vulnerabilities in OpenJDK 10 for Ubuntu 18.04 LTS.\nUnfortunately, that update introduced a regression around accessability\nsupport that prevented some Java applications from starting.\nThis update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that OpenJDK did not properly validate types in some\n situations. An attacker could use this to construct a Java class that could\n possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826)\n\n It was discovered that the PatternSyntaxException class in OpenJDK did not\n properly validate arguments passed to it. An attacker could use this to\n potentially construct a class that caused a denial of service (excessive\n memory consumption). (CVE-2018-2952)\n\n Daniel Bleichenbacher discovered a vulnerability in the Galois/Counter Mode\n (GCM) mode of operation for symmetric block ciphers in OpenJDK. An attacker\n could use this to expose sensitive information. (CVE-2018-2972)\n","status":"published","published":"2018-09-12T22:13:03Z","modified":"2026-02-10T04:41:23Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}