SB2018101910 - OpenSUSE Linux update for java-11-openjdk

Description

This security bulletin contains information about 8 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2018-3136)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Security component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

2) Improper input validation (CVE-ID: CVE-2018-3139)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Networking component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

3) Improper input validation (CVE-ID: CVE-2018-3149)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the JNDI component in JRockit. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

4) Improper input validation (CVE-ID: CVE-2018-3150)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Utility component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

5) Improper input validation (CVE-ID: CVE-2018-3157)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Sound component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

6) Improper input validation (CVE-ID: CVE-2018-3169)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Hotspot component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

7) Security restrictions bypass (CVE-ID: CVE-2018-3180)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to insufficient privileges and access controls. A remote attacker can bypass security restrictions to conduct further attacks.

8) Improper input validation (CVE-ID: CVE-2018-3183)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Scripting component in JRockit. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00041.html