Summary
It was discovered that the Serialization component of OpenJDK did not
properly handle the deserialization of some CORBA objects. An attacker
could possibly use this to bypass Java sandbox restrictions.
(CVE-2023-21830)
Markus Loewe discovered that the Java Sound subsystem in OpenJDK did not
properly validate the origin of a Soundbank. An attacker could use this to
specially craft an untrusted Java application or applet that could load a
Soundbank from an attacker controlled remote URL. (CVE-2023-21843)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | openjdk-8 | 8u362-ga-0ubuntu1~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | openjdk-8 | 8u362-ga-0ubuntu1~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | openjdk-8 | 8u362-ga-0ubuntu1~22.04 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openjdk-8 | 8u362-ga-0ubuntu1~16.04.1 |
Vulnerabilities 2
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Su…