OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476) * OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426) * OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) (CVE-2022-21434) * OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8 [More...]. Synopsis: Important: java-11-openjdk security, bug fix, and enhancement update Advisory ID: SLSA-2022:1440-1 Issue Date: 2022-04-20 CVE Numbers: CVE-2022-21426 CVE-2022-21443 CVE-2022-21434 CVE-2022-21476 CVE-2022-21496 -- The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.15.0.9). Security Fix(es): * OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476) * OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426) * OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) (CVE-2022-21434) * OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443) * OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE -- SL7 x86_64 java-11-openjdk-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-debuginfo-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-debuginfo-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-headless-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-headless-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-demo-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-demo-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-devel-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-devel-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-javadoc-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-javadoc-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-javadoc-zip-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-jmods-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-jmods-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-src-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-src-11.0.15.0.9-2.el7_9.x86_64.rpm java-11-openjdk-static-libs-11.0.15.0.9-2.el7_9.i686.rpm java-11-openjdk-static-libs-11.0.15.0.9-2.el7_9.x86_64.rpm - Scientific Linux Development Team . Important update for java-11-openjdk addresses various vulnerabilities including unrestrained memory usage and input verification errors.. Java 11 Security, OpenJDK Patch, Memory Allocation Issue. . Severity: Important. LinuxSecurity.com Team
An update that fixes four vulnerabilities is now available. . SUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:14887-1 Rating: important References: #1107874 #1109845 #1194471 Cross-References: CVE-2018-16151 CVE-2018-16152 CVE-2018-17540 CVE-2021-45079 CVSS scores: CVE-2018-16151 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-16151 (SUSE): 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2018-16152 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-16152 (SUSE): 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2018-17540 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-17540 (SUSE): 7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H CVE-2021-45079 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2021-45079 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L Affected Products: SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Server 11-SP4-LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for strongswan fixes the following issues: - CVE-2018-16151: Fixed flaws in gmp plugin that could lead to authorization bypass. (bsc#1107874) - CVE-2018-16152: Fixed flaws in gmp plugin that could lead to authorization bypass. (bsc#1107874) - CVE-2018-17540: Fixed insufficient input validation in gmp plugin. (bsc#1109845) - CVE-2021-45079: Fixed authentication bypass in EAP authentication. (bsc#1194471) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-strongswan-14887=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-strongswan-14887=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-strongswan-14887=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-strongswan-14887=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64): strongswan-4.4.0-6.36.12.1 strongswan-doc-4.4.0-6.36.12.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): strongswan-4.4.0-6.36.12.1 strongswan-doc-4.4.0-6.36.12.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64): strongswan-debuginfo-4.4.0-6.36.12.1 strongswan-debugsource-4.4.0-6.36.12.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): strongswan-debuginfo-4.4.0-6.36.12.1 strongswan-debugsource-4.4.0-6.36.12.1 References: https://www.suse.com/security/cve/CVE-2018-16151.html https://www.suse.com/security/cve/CVE-2018-16152.html https://www.suse.com/security/cve/CVE-2018-17540.html https://www.suse.com/security/cve/CVE-2021-45079.html https://bugzilla.suse.com/1107874 https://bugzilla.suse.com/1109845 https://bugzilla.suse.com/1194471 . An update has resolved four vulnerabilities in strongswan, highlighting an authentication bypass and input validation flaws. Follow the instructions below to apply these patches. strongswan Fix, SUSE Security Patch, Authentication Bypass Fix. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.