openSUSE-SU-2022:0816-1: moderate: Security update for java-11-openjdk

SUSE 5090 Published by

A java-11-openjdk security update has been released for openSUSE Leap 15.3.



openSUSE-SU-2022:0816-1: moderate: Security update for java-11-openjdk


openSUSE Security Update: Security update for java-11-openjdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2022:0816-1
Rating: moderate
References: #1194925 #1194926 #1194927 #1194928 #1194929
#1194930 #1194931 #1194932 #1194933 #1194934
#1194935 #1194937 #1194939 #1194940 #1194941

Cross-References: CVE-2022-21248 CVE-2022-21277 CVE-2022-21282
CVE-2022-21283 CVE-2022-21291 CVE-2022-21293
CVE-2022-21294 CVE-2022-21296 CVE-2022-21299
CVE-2022-21305 CVE-2022-21340 CVE-2022-21341
CVE-2022-21360 CVE-2022-21365 CVE-2022-21366

CVSS scores:
CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-21277 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21277 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-21283 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21283 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21291 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-21291 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21366 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-21366 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:
openSUSE Leap 15.3
______________________________________________________________________________

An update that fixes 15 vulnerabilities is now available.

Description:

This update for java-11-openjdk fixes the following issues:

- CVE-2022-21248: Fixed incomplete deserialization class filtering in
ObjectInputStream. (bnc#1194926)
- CVE-2022-21277: Fixed incorrect reading of TIFF files in
TIFFNullDecompressor. (bnc#1194930)
- CVE-2022-21282: Fixed Insufficient URI checks in the XSLT
TransformerImpl. (bnc#1194933)
- CVE-2022-21283: Fixed unexpected exception thrown in regex Pattern.
(bnc#1194937)
- CVE-2022-21291: Fixed Incorrect marking of writeable fields.
(bnc#1194925)
- CVE-2022-21293: Fixed Incomplete checks of StringBuffer and
StringBuilder during deserialization. (bnc#1194935)
- CVE-2022-21294: Fixed Incorrect IdentityHashMap size checks during
deserialization. (bnc#1194934)
- CVE-2022-21296: Fixed Incorrect access checks in XMLEntityManager.
(bnc#1194932)
- CVE-2022-21299: Fixed Infinite loop related to incorrect handling of
newlines in XMLEntityScanner. (bnc#1194931)
- CVE-2022-21305: Fixed Array indexing issues in LIRGenerator.
(bnc#1194939)
- CVE-2022-21340: Fixed Excessive resource use when reading JAR manifest
attributes. (bnc#1194940)
- CVE-2022-21341: Fixed OpenJDK: Insufficient checks when deserializing
exceptions in ObjectInputStream. (bnc#1194941)
- CVE-2022-21360: Fixed Excessive memory allocation in BMPImageReader.
(bnc#1194929)
- CVE-2022-21365: Fixed Integer overflow in BMPImageReader. (bnc#1194928)
- CVE-2022-21366: Fixed Excessive memory allocation in TIFF*Decompressor.
(bnc#1194927)

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.3:

zypper in -t patch openSUSE-SLE-15.3-2022-816=1


Package List:

- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):

java-11-openjdk-11.0.14.0-3.74.2
java-11-openjdk-accessibility-11.0.14.0-3.74.2
java-11-openjdk-accessibility-debuginfo-11.0.14.0-3.74.2
java-11-openjdk-debugsource-11.0.14.0-3.74.2
java-11-openjdk-demo-11.0.14.0-3.74.2
java-11-openjdk-devel-11.0.14.0-3.74.2
java-11-openjdk-headless-11.0.14.0-3.74.2
java-11-openjdk-jmods-11.0.14.0-3.74.2
java-11-openjdk-src-11.0.14.0-3.74.2

- openSUSE Leap 15.3 (noarch):

java-11-openjdk-javadoc-11.0.14.0-3.74.2

References:

  https://www.suse.com/security/cve/CVE-2022-21248.html
  https://www.suse.com/security/cve/CVE-2022-21277.html
  https://www.suse.com/security/cve/CVE-2022-21282.html
  https://www.suse.com/security/cve/CVE-2022-21283.html
  https://www.suse.com/security/cve/CVE-2022-21291.html
  https://www.suse.com/security/cve/CVE-2022-21293.html
  https://www.suse.com/security/cve/CVE-2022-21294.html
  https://www.suse.com/security/cve/CVE-2022-21296.html
  https://www.suse.com/security/cve/CVE-2022-21299.html
  https://www.suse.com/security/cve/CVE-2022-21305.html
  https://www.suse.com/security/cve/CVE-2022-21340.html
  https://www.suse.com/security/cve/CVE-2022-21341.html
  https://www.suse.com/security/cve/CVE-2022-21360.html
  https://www.suse.com/security/cve/CVE-2022-21365.html
  https://www.suse.com/security/cve/CVE-2022-21366.html
  https://bugzilla.suse.com/1194925
  https://bugzilla.suse.com/1194926
  https://bugzilla.suse.com/1194927
  https://bugzilla.suse.com/1194928
  https://bugzilla.suse.com/1194929
  https://bugzilla.suse.com/1194930
  https://bugzilla.suse.com/1194931
  https://bugzilla.suse.com/1194932
  https://bugzilla.suse.com/1194933
  https://bugzilla.suse.com/1194934
  https://bugzilla.suse.com/1194935
  https://bugzilla.suse.com/1194937
  https://bugzilla.suse.com/1194939
  https://bugzilla.suse.com/1194940
  https://bugzilla.suse.com/1194941



ELSA-2022-0850 Important: Oracle Linux 7 thunderbird security update (aarch64)

httpd (SSA:2022-073-01)

Windows

Linux

macOS

Community

  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...
  • Philipp
    I would try the XanMod kernel: https://xanmod.org  I ...