Download
| Alert*
|
oval:org.secpod.oval:def:704548
openjdk-9-jdk is installed oval:org.secpod.oval:def:1900761 It was discovered that the JAXP component in OpenJDK did not properly limit the amount of memory allocated when performing deserializations. An attacker could use this to cause a denial of service . oval:org.secpod.oval:def:1901201 It was discovered that the HTTPUrlConnection classes in OpenJDK did not properly handle newlines. An attacker could use this to convince a Java application or applet to inject headers into http requests. oval:org.secpod.oval:def:1901343 Francesco Palmarini, Marco Squarcina, Mauro Tempesta, Riccardo Focardi, and Tobias Ospelt discovered that the Security component in OpenJDK did not sufficiently protect password-based encryption keys in key stores. An attacker could use this to expose sensitive information. oval:org.secpod.oval:def:1901015 It was discovered that the Serialization component of OpenJDK did not properly limit the amount of memory allocated when performing deserializations. An attacker could use this to cause a denial of service . oval:org.secpod.oval:def:1900690 Jeffrey Altman discovered that the Kerberos client implementation in OpenJDK incorrectly trusted unauthenticated portions of Kerberos tickets. A remote attacker could use this to impersonate trusted network services or perform other attacks. oval:org.secpod.oval:def:1901185 It was discovered that the Remote Method Invocation component in OpenJDK did not properly handle unreferenced objects. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. oval:org.secpod.oval:def:1901253 Gaston Traberg discovered that the Serialization component of OpenJDK did not properly limit the amount of memory allocated when performing deserializations in the SimpleTimeZone class. An attacker could use this to cause a denial of service . oval:org.secpod.oval:def:1901318 Gaston Traberg discovered that the Serialization component of OpenJDK did not properly limit the amount of memory allocated when performing deserializations. An attacker could use this to cause a denial of service . oval:org.secpod.oval:def:1901205 It was discovered that the Hotspot component of OpenJDK did not properly perform loader checks when handling the invokespecial JVM instruction. An attacker could use this to specially construct an untrusted Java application or applet that could escape sandbox restrictions. oval:org.secpod.oval:def:1901447 It was discovered that the Networking component of OpenJDK did not properly set timeouts on FTP client actions. A remote attacker could use this to cause a denial of service . oval:org.secpod.oval:def:1900180 Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and RiccardoFocardi discovered that the Serialization component of OpenJDK did not properly restrict the amount of memory allocated when deserializingobjects from Java Cryptography Extension KeyStore . An attacker could use this to cause a denial ... oval:org.secpod.oval:def:1901183 It was discovered that the Serialization component of OpenJDK did not properly limit the amount of memory allocated when performing deserializations. An attacker could use this to cause a denial of service . |
