Red Hat Security Advisory

RHSA-2018:2713

java-1.8.0-ibm security update

Released 2018-09-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.20-1jpp.1.el6_10

Fixes 9 records

TI-2016-00634 CVE-2016-0705 · GHSA-jq9m-v5x9-ppg9

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in…

MEDIUM 64

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possi…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.26335 Published 2016-03-03 Partial fix

TI-2017-02849 CVE-2017-3732 · GHSA-5hg3-8gvm-5294

BN_mod_exp may produce incorrect results on x86_64

MEDIUM 42

There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.154 Published 2017-05-04 Partial fix CWE-200

TI-2017-02852 CVE-2017-3736 · GHSA-72w7-9ghx-p5pg

Information disclosure in OpenSSL

MEDIUM 41

There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.10133 Published 2017-11-02 Partial fix CWE-200

TI-2018-01470 CVE-2018-1656 · GHSA-x34g-2xv6-mxf5

Path traversal in IBM SDK, Java Technology Edition

MEDIUM 40

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files.

CVSS 3.0HIGH 7.4 Network No auth User interaction EPSS 0.04456 Published 2018-08-20 Fixed CWE-22

TI-2018-01383 CVE-2018-1517 · GHSA-m9w3-gv68-h6xv

Improper input validation in IBM SDK, Java Technology Edition

MEDIUM 40

A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03931 Published 2018-08-20 Fixed CWE-20

TI-2018-08998 CVE-2018-12539 · GHSA-8xmg-5xjr-x475

Deserialization of untrusted data in Eclipse OpenJ9

LOW 35

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the abilit…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00494 Published 2018-08-14 Fixed CWE-419

TI-2018-02276 CVE-2018-2973 · GHSA-pj6g-h9ch-r92c

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 34

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.04667 Published 2018-07-18 Partial fix

TI-2018-02243 CVE-2018-2940 · GHSA-vc69-2m84-9mmr

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 26

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.03132 Published 2018-07-18 Partial fix

TI-2018-02255 CVE-2018-2952 · GHSA-pvp8-49wp-gw4c

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 25

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.04426 Published 2018-07-18 Partial fix