KLA12237 Multiple vulnerabilities in Oracle Java SE

Multiple vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, cause denial of service.

Below is a complete list of vulnerabilities:

1. Security vulnerability can be exploited remotely to bypass security restrictions.
2. Information disclosure vulnerability can be exploited remotely to obtain sensitive information.
3. Denial of service vulnerability can be exploited remotely to cause denial of service.
4. Security vulnerability can be exploited to bypass security restrictions.

Original advisories

Oracle Critical Patch Update Advisory – April 2021

Related products

Oracle-Java-JDK-1.7.x

Oracle-Java-JDK-1.8.x-3

CVE list

CVE-2021-2369 warning

CVE-2021-2341 warning

CVE-2021-2432 warning

CVE-2021-2388 critical

Solution

Update to the latest version

Download Java

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Java SE: 7u301, 8u291, 11.0.11, 16.0.1