Improper input validation in Java SE Embedded - CVE-2020-14581

Vulnerability identifier: #VU30077

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14581

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the 2D component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Java SE Embedded
Oracle Java SE
Gentoo Linux
Debian Linux
Opensuse
Ubuntu
openEuler
Fedora
IBM Cloud Transformation Advisor
IBM Security Access Manager for Enterprise Single-Sign On
IBM Cloud Pak for Business Automation
IBM Cloud Application Business Insights
IBM Tivoli Monitoring
EMC Data Protection Advisor
openjdk7 (Alpine package)
openjdk8 (Alpine package)
openjdk11 (Alpine package)
java-1.8.0-openjdk
openjdk-8-jdk (Ubuntu package)
openjdk-8-jre-jamvm (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jre-zero (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
openjdk-11-jre (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
openjdk-11 (Debian package)
java-11-openjdk
java-latest-openjdk-slowdebug
java-latest-openjdk-devel
java-latest-openjdk-devel-slowdebug
java-latest-openjdk-headless
java-latest-openjdk-headless-slowdebug
java-latest-openjdk-javadoc
java-latest-openjdk-javadoc-zip
java-latest-openjdk-jmods
java-latest-openjdk-jmods-slowdebug
java-latest-openjdk-demo-slowdebug
java-latest-openjdk-src-slowdebug
java-latest-openjdk-src
java-latest-openjdk
java-latest-openjdk-demo
IBM Cloud Pak System
EMC ECS
Dell EMC NetWorker Runtime Environment (NRE)
Solutions Enabler
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
Dell EMC VxRail Appliance
Solutions Enabler Virtual Appliance

Install updates from vendor's website.

openjdk8 (Alpine package) - update to 8.272.10-r0
openjdk11 (Alpine package) - update to 11.0.8_p10-r0
IBM Cloud Pak for Business Automation - update to 20.0.2 ifix 001
IBM Cloud Application Business Insights - addressed in versions 1.1.3.1, 1.1.4.2
java-1.8.0-openjdk - addressed in versions 1.8.0.262.b10-1.fc31, 1.8.0.262.b10-1.fc32
IBM Cloud Pak System - update to 2.3.3.7
EMC ECS - addressed in versions 3.5.1.1, 3.6
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 6
Dell EMC VxRail Appliance - update to 7.0.100
openjdk-8-jdk (Ubuntu package) - addressed in versions 8u265-b01-0ubuntu2~16.04, 8u265-b01-0ubuntu2~18.04, 8u265-b01-0ubuntu2~20.04
openjdk-8-jre-jamvm (Ubuntu package) - update to 8u265-b01-0ubuntu2~16.04
openjdk-8-jre (Ubuntu package) - addressed in versions 8u265-b01-0ubuntu2~16.04, 8u265-b01-0ubuntu2~18.04, 8u265-b01-0ubuntu2~20.04
openjdk-8-jre-headless (Ubuntu package) - addressed in versions 8u265-b01-0ubuntu2~16.04, 8u265-b01-0ubuntu2~18.04, 8u265-b01-0ubuntu2~20.04
openjdk-8-jre-zero (Ubuntu package) - addressed in versions 8u265-b01-0ubuntu2~16.04, 8u265-b01-0ubuntu2~18.04, 8u265-b01-0ubuntu2~20.04
Dell EMC NetWorker Runtime Environment (NRE) - update to 8.0.6
Solutions Enabler - addressed in versions 9.0.0.19, 9.1.0.10
Solutions Enabler Virtual Appliance - addressed in versions 9.0.0.19, 9.1.0.10
Unisphere for PowerMax - addressed in versions 9.0.2.19, 9.1.0.20
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.0.2.19, 9.1.0.20
openjdk-11-jre-headless (Ubuntu package) - addressed in versions 11.0.8+10-0ubuntu1~18.04.1, 11.0.8+10-0ubuntu1~20.04
openjdk-11-jre (Ubuntu package) - addressed in versions 11.0.8+10-0ubuntu1~18.04.1, 11.0.8+10-0ubuntu1~20.04
openjdk-11-jdk (Ubuntu package) - addressed in versions 11.0.8+10-0ubuntu1~18.04.1, 11.0.8+10-0ubuntu1~20.04
openjdk-11-jre-zero (Ubuntu package) - addressed in versions 11.0.8+10-0ubuntu1~18.04.1, 11.0.8+10-0ubuntu1~20.04
openjdk-11 (Debian package) - update to 11.0.8+10-1~deb10u1
java-11-openjdk - addressed in versions 11.0.8.10-2.fc31, 11.0.8.10-2.fc32
EMC Data Protection Advisor - addressed in versions 19.4.0 B21, 19.5
java-latest-openjdk-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-devel - update to 23.0.1.11-1
java-latest-openjdk-devel-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-headless - update to 23.0.1.11-1
java-latest-openjdk-headless-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-javadoc - update to 23.0.1.11-1
java-latest-openjdk-javadoc-zip - update to 23.0.1.11-1
java-latest-openjdk-jmods - update to 23.0.1.11-1
java-latest-openjdk-jmods-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-demo-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-src-slowdebug - update to 23.0.1.11-1
java-latest-openjdk-src - update to 23.0.1.11-1
java-latest-openjdk - update to 23.0.1.11-1
java-latest-openjdk-demo - update to 23.0.1.11-1

• https://www.oracle.com/security-alerts/cpujul2020.html

• Multiple vulnerabilities in Java SE Embedded
• Multiple vulnerabilities in Java SE
• OpenSUSE Linux update for java-11-openjdk
• OpenSUSE Linux update for java-11-openjdk
• Improper input validation in openjdk11 (Alpine package)
• OpenSUSE Linux update for java-1_8_0-openj9
• Improper input validation in openjdk8 (Alpine package)
• Improper input validation in openjdk7 (Alpine package)
• Debian update for openjdk-11
• Gentoo update for Oracle JDK JRE
• Multiple vulnerabilities in Dell EMC Data Protection Advisor (DPA)
• Multiple vulnerabilities in Dell EMC ECS
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell EMC NetWorker Runtime Environment (NRE)
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler
• IBM Tivoli Monitoring update for IBM Java SDK
• IBM Cloud Application Business Insights update for IBM SDK Java
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vunerabilities in IBM Cloud Pak System
• Gentoo update for IcedTea
• Multiple vulnerabilities in IBM Security Access Manager for Enterprise Single-Sign On
• openEuler 22.03 LTS SP4 update for openjdk-latest
• openEuler 24.03 LTS update for openjdk-latest
• openEuler 22.03 LTS SP1 update for openjdk-latest
• openEuler 20.03 LTS SP4 update for openjdk-latest
• openEuler 22.03 LTS SP3 update for openjdk-latest
• Ubuntu update for openjdk-lts
• Ubuntu update for openjdk-8
• Fedora 32 update for java-1.8.0-openjdk
• Fedora 31 update for java-1.8.0-openjdk
• Fedora 32 update for java-11-openjdk
• Fedora 31 update for java-11-openjdk
• Multiple vulnerabilities in IBM Cloud Pak for Automation