Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 17.10 USN-3644-1: Important Security Notice for OpenJDK 8

ubuntu
Calendar Grey May 11, 2018
Scroller Ubuntu
To safeguard your system against vulnerabilities linked to memory handling and unauthorized access, updating OpenJDK in Ubuntu is crucial. Follow the steps provided to do this.
Several security issues were fixed in OpenJDK 8.

Summary

Several security issues were fixed in OpenJDK 8.

Software Description:

- openjdk-8: Open Source Java implementation

Details:

It was discovered that the Security component of OpenJDK did not

correctly perform merging of multiple sections for the same file listed

in JAR archive file manifests. An attacker could possibly use this to

modify attributes in a manifest without invalidating the signature.

(CVE-2018-2790)

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo Focardi

discovered that the Security component of OpenJDK did not restrict which

classes could be used when deserializing keys from the JCEKS key stores. An

attacker could use this to specially craft a JCEKS key store to execute

arbitrary code. (CVE-2018-2794)

It was discovered that the Security component of OpenJDK in some situations

did not properly limit the amount of memory allocated when performing

deserialization. An attacker could use this to cause a denial of service

(memory exhaustion). (CVE-20...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory remote access Ubuntu memory exhaustion security issues OpenJDK

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  openjdk-8-jre                   8u171-b11-0ubuntu0.17.10.1
  openjdk-8-jre-headless          8u171-b11-0ubuntu0.17.10.1
  openjdk-8-jre-zero              8u171-b11-0ubuntu0.17.10.1

Ubuntu 16.04 LTS:
  openjdk-8-jre                   8u171-b11-0ubuntu0.16.04.1
  openjdk-8-jre-headless          8u171-b11-0ubuntu0.16.04.1
  openjdk-8-jre-jamvm             8u171-b11-0ubuntu0.16.04.1
  openjdk-8-jre-zero              8u171-b11-0ubuntu0.16.04.1

This update uses a new upstream release, which includes additional
bug fixes. After a standard system update you need to restart any
Java applications or applets to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3644-1

CVE-2018-2783, CVE-2018-2790, CVE-2018-2794, CVE-2018-2795,

CVE-2018-2796, CVE-2018-2797, CVE-2018-2798, CVE-2018-2799,

CVE-2018-2800, CVE-2018-2814, CVE-2018-2815

Severity
important
Lowest
Low
Medium
High
Critical

May 11, 2018

Topics%20covered

Topics Covered

security advisory remote access Ubuntu memory exhaustion security issues OpenJDK

Package Information

https://launchpad.net/ubuntu/+source/openjdk-8/8u171-b11-0ubuntu0.17.10.1
https://launchpad.net/ubuntu/+source/openjdk-8/8u171-b11-0ubuntu0.16.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.