Important: java-1.8.0-openjdk security update

2024-07-1700:00:00

Google

osv.dev

java runtime environment

software development kit

openjdk

security update

cve-2024-21147

cve-2024-21131

cve-2024-21138

cve-2024-21140

cve-2024-21144

cve-2024-21145

rangecheckelimination

utf8 size overflow

excessive symbol length

pack200

out-of-bounds access

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

6.8

Confidence

Low

JSON

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)
OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)
OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)
OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)
OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)
OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.