KLA12331 Multiple vulnerabilities in Oracle Java SE

Multiple vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, cause denial of service, gain privileges, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. Security vulnerability in JSSE component can be exploited remotely to bypass security restrictions.
2. Security vulnerability can be exploited remotely to bypass security restrictions.
3. Vulnerability in JSSE component of Java SE can be exploited to cause denial of service.
4. Vulnerability in Keytool component of Java SE can be exploited to obtain sensitive information;
5. Security vulnerability in Hotspot component can be exploited remotely to bypass security restrictions.
6. Vulnerability in Utility component of Java SE can be exploited to cause denial of service.
7. Vulnerability in Swing component of Java SE can be exploited to cause denial of service.
8. Vulnerability in JSSE component of Java SE can be exploited to obtain sensitive information;
9. Vulnerability in ImageIO component of Java SE can be exploited to obtain sensitive information;
10. Vulnerability in Libraries component of Java SE can be exploited to obtain sensitive information.
11. A remote code execution vulnerability in Deployment component can be exploited remotely to execute arbitrary code.

Original advisories

Oracle Critical Patch Update Advisory – October 2021

Related products

Oracle-Java-JRE-1.7.x

Oracle-Java-JRE-1.8.x

CVE list

CVE-2021-35603 warning

CVE-2021-3517 critical

CVE-2021-35578 high

CVE-2021-35564 high

CVE-2021-35588 warning

CVE-2021-35561 high

CVE-2021-35559 high

CVE-2021-35550 high

CVE-2021-35586 high

CVE-2021-35556 high

CVE-2021-35567 high

CVE-2021-3522 high

CVE-2021-35565 high

CVE-2021-35560 critical

Solution

Update to the latest version

Download Java

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Java SE: 7u311, 8u301, 11.0.12, 17;