KLA11403 Multiple vulnerabilities in Oracle Java SE

Multiple vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A divide by zero vulnerability in libjpeg (ImageIO component) can be exploited remotely to cause denial of service;
2. A vulnerability in Networking component can be exploited remotely to obtain sensitive information;
3. A vulnerability in Deployment component can be exploited remotely to cause denial of service;
4. A vulnerability in Libraries component can be exploited remotely to obtain sensitive information;

Original advisories

Oracle Critical Patch Update Advisory – January 2019

Related products

Oracle-Java-JRE-1.7.x

Oracle-Java-JRE-1.8.x

CVE list

CVE-2018-11212 warning

CVE-2019-2426 warning

CVE-2019-2449 warning

CVE-2019-2422 warning

Solution

Update to the latest version

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• LoI

Loss of integrity. Exploitation of vulnerabilities with this impact can lead to partial system fault or system components connection disruption.

Affected Products

• Oracle Java JRE 1.8.x earlier than 8u201