Skip to content
OpenAdvisories
High ALAS2-2019-1316 17 CVEs

Important: java-11-amazon-corretto security update (Amazon Linux 2)

Published Oct 15, 2019 · Updated Oct 16, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2999: No description is available for this CVE. 99999: CVE-2019-2999 OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) CVE-2019-2992: No description is available for this CVE. 99999: CVE-2019-2992 OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) CVE-2019-2989: No description is available for this CVE. 99999: CVE-2019-2989 OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) CVE-2019-2988: No description is available for this CVE. 99999: CVE-2019-2988 OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) CVE-2019-2987: No description is available for this CVE. 99999: CVE-2019-2987 OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) CVE-2019-2983: No description is available for this CVE. 99999: CVE-2019-2983 OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) CVE-2019-2981: No description is available for this CVE. 99999: CVE-2019-2981 OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) CVE-2019-2978: No description is available for this CVE. 99999: CVE-2019-2978 OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) CVE-2019-2977: No description is available for this CVE. 99999: CVE-2019-2977 OpenJDK: Out of bounds access in optimized String indexof implementation (Hotspot, 8224062) CVE-2019-2975: No description is available for this CVE. 99999: CVE-2019-2975 OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) CVE-2019-2973: No description is available for this CVE. 99999: CVE-2019-2973 OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) CVE-2019-2964: No description is available for this CVE. 99999: CVE-2019-2964 OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) CVE-2019-2962: No description is available for this CVE. 99999: CVE-2019-2962 OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) CVE-2019-2958: 99999: CVE-2019-2949: No description is available for this CVE. 99999: CVE-2019-2949 OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) CVE-2019-2945: No description is available for this CVE. 99999: CVE-2019-2945 OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) CVE-2019-2894: 99999:

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 java-11-amazon-corretto 1:11.0.5+10-1.amzn2
Amazon Linux · 2 java-11-amazon-corretto-headless 1:11.0.5+10-1.amzn2
Amazon Linux · 2 java-11-amazon-corretto-javadoc 1:11.0.5+10-1.amzn2

Vulnerabilities 17

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2894.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2945.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2949.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2958.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2962.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2964.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2973.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2975.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2977.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2978.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2981.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2983.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2987.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2988.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2989.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2992.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-2999.html