MGASA-2024-0319 - Updated java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, & java-latest-openjdk packages fix security vulnerabilities

Publication date: 27 Sep 2024
URL: https://advisories.mageia.org/MGASA-2024-0319.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-21131,
     CVE-2024-21138,
     CVE-2024-21140,
     CVE-2024-21144,
     CVE-2024-21145,
     CVE-2024-21147

Potential UTF8 size overflow. (CVE-2024-21131)
Excessive symbol length can lead to infinite loop. (CVE-2024-21138)
Range Check Elimination (RCE) pre-loop limit overflow. (CVE-2024-21140)
Pack200 increase loading time due to improper header validation.
(CVE-2024-21144)
Out-of-bounds access in 2D image handling. (CVE-2024-21145)
RangeCheckElimination array index overflow. (CVE-2024-21147)

References:
- https://bugs.mageia.org/show_bug.cgi?id=33413
- https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2024:4560
- https://access.redhat.com/errata/RHSA-2024:4567
- https://access.redhat.com/errata/RHSA-2024:4568
- java-latest-openjdk-22.0.2.0.9-1.rolling.1.mga9
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21131
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21138
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21140
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21144
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21145
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21147

SRPMS:
- 9/core/java-1.8.0-openjdk-1.8.0.422.b05-1.mga9
- 9/core/java-11-openjdk-11.0.24.0.8-1.mga9
- 9/core/java-17-openjdk-17.0.12.0.7-1.mga9
- 9/core/java-latest-openjdk-22.0.2.0.9-1.rolling.1.mga9

Mageia 2024-0319: java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, & java-latest-openjdk Security Advisory Updates

Potential UTF8 size overflow

Summary

Potential UTF8 size overflow. (CVE-2024-21131) Excessive symbol length can lead to infinite loop. (CVE-2024-21138) Range Check Elimination (RCE) pre-loop limit overflow. (CVE-2024-21140) Pack200 increase loading time due to improper header validation. (CVE-2024-21144) Out-of-bounds access in 2D image handling. (CVE-2024-21145) RangeCheckElimination array index overflow. (CVE-2024-21147)

References

- https://bugs.mageia.org/show_bug.cgi?id=33413

- https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

- https://access.redhat.com/errata/RHSA-2024:4560

- https://access.redhat.com/errata/RHSA-2024:4567

- https://access.redhat.com/errata/RHSA-2024:4568

- java-latest-openjdk-22.0.2.0.9-1.rolling.1.mga9

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21131

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21138

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21140

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21144

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21145

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21147

Resolution

MGASA-2024-0319 - Updated java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, & java-latest-openjdk packages fix security vulnerabilities

SRPMS

- 9/core/java-1.8.0-openjdk-1.8.0.422.b05-1.mga9

- 9/core/java-11-openjdk-11.0.24.0.8-1.mga9

- 9/core/java-17-openjdk-17.0.12.0.7-1.mga9

- 9/core/java-latest-openjdk-22.0.2.0.9-1.rolling.1.mga9

Severity
Publication date: 27 Sep 2024
URL: https://advisories.mageia.org/MGASA-2024-0319.html
Type: security
CVE: CVE-2024-21131, CVE-2024-21138, CVE-2024-21140, CVE-2024-21144, CVE-2024-21145, CVE-2024-21147

Related News

Google Releases Chrome 130 with Critical Security Fixes for 17 Flaws
3 - 5 min read
Google recently unveiled Chrome 130 , an update that addresses several security vulnerabilities to ensure the web browser's safety and reliability.
U.S. Investigation into China-Backed Telecom Companies Hack: The Role & Risks of Encryption Backdoors
3 - 5 min read
U.S. authorities are on high alert as they investigate an alleged Chinese state-sponsored hack targeting major U.S. telecommunications companies.
FASTCash Linux Malware: A New Cybercrime Menace Targeting Payment Switch Systems
3 - 5 min read
As malware threats evolve to increasingly target Linux systems, admins and organizations must stay up-to-date on the latest Linux malware variants
Optimizing CWPP on Linux Servers: Best Practices and Configurations
3 - 6 min read
Cloud Workload Protection Platforms are now essential for securing virtual environments. These provide a robust security layer vital for addressing
The Infiltration of Supply Chain Attacks in Open-Source Software Management
3 - 6 min read
Open-source projects are renowned for their collaborative nature and widespread adoption, yet more sophisticated supply chain attacks target them
Strengthen Your Linux Software Development Pipeline with Code Security Scanners
3 - 6 min read
Developers recognize the critical nature of protecting software systems as cyberattacks grow more sophisticated, thus necessitating robust security
Everything You Need to Know About Cloud Security Posture Management
3 - 5 min read
Many companies are transitioning from physical servers to cloud operations, but this transformation brings new challenges. Cloud Security Posture
Understanding the Critical Oath-Toolkit Vulnerability and Its Implications for Admins
3 - 5 min read
As Linux security threats advance and evolve, vulnerabilities often surface unexpectedly, exposing systems to potential exploitation. SUSE

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved