Security update for java-11-openjdk SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:2247-1 Final 1 1 2018-08-08T19:01:34Z current 2018-08-08T19:01:34Z 2018-08-08T19:01:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for java-11-openjdk This java-11-openjdk update to version jdk-11+24 fixes the following issues: Security issues fixed: - CVE-2018-2940: Fix unspecified vulnerability in subcomponent Libraries (bsc#1101645). - CVE-2018-2952: Fix unspecified vulnerability in subcomponent Concurrency (bsc#1101651). - CVE-2018-2972: Fix unspecified vulnerability in subcomponent Security (bsc#1101655). - CVE-2018-2973: Fix unspecified vulnerability in subcomponent JSSE (bsc#1101656). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00025.html E-Mail link for openSUSE-SU-2018:2247-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.0 java-11-openjdk-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 java-11-openjdk-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 as a component of openSUSE Leap 15.0 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). CVE-2018-2940 openSUSE Leap 15.0:java-11-openjdk-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00025.html https://www.suse.com/security/cve/CVE-2018-2940.html CVE-2018-2940 https://bugzilla.suse.com/1101645 SUSE Bug 1101645 https://bugzilla.suse.com/1101651 SUSE Bug 1101651 https://bugzilla.suse.com/1101653 SUSE Bug 1101653 https://bugzilla.suse.com/1101656 SUSE Bug 1101656 https://bugzilla.suse.com/1104668 SUSE Bug 1104668 https://bugzilla.suse.com/1112147 SUSE Bug 1112147 https://bugzilla.suse.com/1112151 SUSE Bug 1112151 https://bugzilla.suse.com/1122292 SUSE Bug 1122292 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171; JRockit: R28.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2018-2952 openSUSE Leap 15.0:java-11-openjdk-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 low Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00025.html https://www.suse.com/security/cve/CVE-2018-2952.html CVE-2018-2952 https://bugzilla.suse.com/1101645 SUSE Bug 1101645 https://bugzilla.suse.com/1101651 SUSE Bug 1101651 https://bugzilla.suse.com/1101653 SUSE Bug 1101653 https://bugzilla.suse.com/1101656 SUSE Bug 1101656 https://bugzilla.suse.com/1104668 SUSE Bug 1104668 https://bugzilla.suse.com/1112147 SUSE Bug 1112147 https://bugzilla.suse.com/1112151 SUSE Bug 1112151 https://bugzilla.suse.com/1122292 SUSE Bug 1122292 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). The supported version that is affected is Java SE: 10.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2018-2972 openSUSE Leap 15.0:java-11-openjdk-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00025.html https://www.suse.com/security/cve/CVE-2018-2972.html CVE-2018-2972 https://bugzilla.suse.com/1101651 SUSE Bug 1101651 https://bugzilla.suse.com/1101653 SUSE Bug 1101653 https://bugzilla.suse.com/1101655 SUSE Bug 1101655 https://bugzilla.suse.com/1112147 SUSE Bug 1112147 https://bugzilla.suse.com/1112151 SUSE Bug 1112151 https://bugzilla.suse.com/1122292 SUSE Bug 1122292 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2018-2973 openSUSE Leap 15.0:java-11-openjdk-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-accessibility-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-demo-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-devel-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-headless-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-javadoc-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-jmods-11.0.0.0~24-lp150.2.3.2 openSUSE Leap 15.0:java-11-openjdk-src-11.0.0.0~24-lp150.2.3.2 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00025.html https://www.suse.com/security/cve/CVE-2018-2973.html CVE-2018-2973 https://bugzilla.suse.com/1101645 SUSE Bug 1101645 https://bugzilla.suse.com/1101651 SUSE Bug 1101651 https://bugzilla.suse.com/1101653 SUSE Bug 1101653 https://bugzilla.suse.com/1101656 SUSE Bug 1101656 https://bugzilla.suse.com/1104668 SUSE Bug 1104668 https://bugzilla.suse.com/1112147 SUSE Bug 1112147 https://bugzilla.suse.com/1112151 SUSE Bug 1112151 https://bugzilla.suse.com/1122292 SUSE Bug 1122292