A jre11-openjdk-headless security update has been released for Arch Linux.

ASA-202107-54: jre11-openjdk-headless: multiple issues

Arch Linux Security Advisory ASA-202107-54
=========================================
Severity: High
Date : 2021-07-21
CVE-ID : CVE-2021-2341 CVE-2021-2369 CVE-2021-2388
Package : jre11-openjdk-headless
Type : multiple issues
Remote : Yes
Link :   https://security.archlinux.org/AVG-2189

Summary
======
The package jre11-openjdk-headless before version 11.0.12.u7-1 is
vulnerable to multiple issues including arbitrary code execution and
information disclosure.

Resolution
=========
Upgrade to 11.0.12.u7-1.

# pacman -Syu "jre11-openjdk-headless>.0.12.u7-1"

The problems have been fixed upstream in version 11.0.12.u7.

Workaround
=========
None.

Description
==========
- CVE-2021-2341 (information disclosure)

A security issue has been found in the Networking component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit
vulnerability allows an unauthenticated attacker with network access
via multiple protocols to compromise OpenJDK. Successful attacks
require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in unauthorized
read access to a subset of OpenJDK accessible data.

Note: This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).

- CVE-2021-2369 (arbitrary code execution)

A security issue has been found in the Library component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. An easily exploitable
vulnerability allows unauthenticated attacker with network access via
multiple protocols to compromise OpenJDK. Successful attacks require
human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in unauthorized update, insert
or delete access to some of the OpenJDK accessible data.

Note : This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).

- CVE-2021-2388 (arbitrary code execution)

A security issue has been found in the Hotspot component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit
vulnerability allows unauthenticated attacker with network access via
multiple protocols to compromise OpenJDK. Successful attacks require
human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in takeover of OpenJDK.

Note : This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).

Impact
=====
A malicious Java application could bypass security restrictions to run
arbitrary code or disclose sensitive information.

References
=========
  https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-July/006954.html
  https://openjdk.java.net/groups/vulnerability/advisories/2021-07-20
  https://www.oracle.com/security-alerts/cpujul2021verbose.html#JAVA
  https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8258432
  https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/ca23657dc7da
  https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8260967
  https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e23ebe923867
  https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8264066
  https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/3588c0c6655e
  https://security.archlinux.org/CVE-2021-2341
  https://security.archlinux.org/CVE-2021-2369
  https://security.archlinux.org/CVE-2021-2388