Debian Security Advisory DSA 4185-1 (openjdk-8 - security update)

Published: 2018-04-27 22:00:00
CVE Author: NIST National Vulnerability Database (NVD)

CVSS Base Vector:
AV:N/AC:H/Au:N/C:P/I:P/A:P

Solution Type:
Vendor Patch

Detection Type:
Linux Distribution Package

Affected Versions:
openjdk-8 on Debian Linux

Recommendations:
For the stable distribution (stretch), these problems have been fixed in version 8u171-b11-1~deb9u1. We recommend that you upgrade your openjdk-8 Linux Distribution Packages. For the detailed security status of openjdk-8 please refer to its security tracker page linked in the references.

Summary:
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, sandbox bypass, execution of arbitrary code or bypass of JAR signature validation.

Detection Method:
This check tests the installed software version using the apt Linux Distribution Package manager.

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

https://nvd.nist.gov/vuln/detail/CVE-2018-2790
https://nvd.nist.gov/vuln/detail/CVE-2018-2794
https://nvd.nist.gov/vuln/detail/CVE-2018-2795
https://nvd.nist.gov/vuln/detail/CVE-2018-2796
https://nvd.nist.gov/vuln/detail/CVE-2018-2797
https://nvd.nist.gov/vuln/detail/CVE-2018-2798
https://nvd.nist.gov/vuln/detail/CVE-2018-2799
https://nvd.nist.gov/vuln/detail/CVE-2018-2800
https://nvd.nist.gov/vuln/detail/CVE-2018-2814
https://nvd.nist.gov/vuln/detail/CVE-2018-2815

References:

https://www.debian.org/security/2018/dsa-4185.html
https://security-tracker.debian.org/tracker/openjdk-8

Search
Severity
Medium
CVSS Score
5.1

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.