Skip to content
OpenAdvisories
Medium · 4.2 CVE-2020-14792 EUVD-2020-6928GHSA-gx8h-w6f7-x7qf

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Jav…

Published Oct 21, 2020 · Updated Sep 26, 2024 · Assigned by oracle

Description

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

Affected products

VendorProductAffectedFixed
Oracle Java SE JDK and JRE Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 11 openjdk-11 11.0.9+11-1 —
Debian 10 openjdk-11 11.0.9+11-1~deb10u1 DSA-4779-1
Debian 9 openjdk-8 8u272-b10-0+deb9u1 DLA-2412-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 icedtea-web No fix yet —
Ubuntu 26.04 LTS icedtea-web No fix yet —
Ubuntu 25.10 icedtea-web No fix yet —
Ubuntu 24.04 LTS icedtea-web No fix yet —
Ubuntu 22.04 LTS icedtea-web No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Ubuntu 20.04 LTS openjdk-8 8u272-b10-0ubuntu1~20.04 USN-4607-2, USN-4607-1
Ubuntu 20.04 LTS openjdk-lts 11.0.9+11-0ubuntu1~20.04 USN-4607-2, USN-4607-1
Ubuntu 18.04 LTS icedtea-web No fix yet —
Ubuntu 18.04 LTS openjdk-8 8u272-b10-0ubuntu1~18.04 USN-4607-2, USN-4607-1
Ubuntu 18.04 LTS openjdk-lts 11.0.9+11-0ubuntu1~18.04.1 USN-4607-2, USN-4607-1
Ubuntu 16.04 LTS openjdk-8 8u272-b10-0ubuntu1~16.04 USN-4607-2, USN-4607-1
Ubuntu 16.04 LTS openjdk-9 +1 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 8 java-1.8.0-openjdk +7 1:1.8.0.272.b10-1.el8_2 RHSA-2020:4347
RHEL 8 java-11-openjdk +8 1:11.0.9.11-0.el8_2 RHSA-2020:4305
RHEL 7 java-1.8.0-openjdk +7 1:1.8.0.272.b10-1.el7_9 RHSA-2020:4350
RHEL 7 java-11-openjdk +8 1:11.0.9.11-0.el7_9 RHSA-2020:4307
RHEL 6 java-1.8.0-openjdk +11 1:1.8.0.272.b10-0.el6_10 RHSA-2020:4348
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.1 EUS java-1.8.0-openjdk +7 1:1.8.0.272.b10-0.el8_1 RHSA-2020:4352
RHEL 8.1 EUS java-11-openjdk +7 1:11.0.9.11-0.el8_1 RHSA-2020:4306
RHEL 8.0 E4S java-1.8.0-openjdk +7 1:1.8.0.272.b10-0.el8_0 RHSA-2020:4349
RHEL 8.0 E4S java-11-openjdk +7 1:11.0.9.11-0.el8_0 RHSA-2020:4316
ReleasePackageFixed inAdvisory
SLES 15 SP2 java-11-openjdk 11.0.9.0-3.48.1 SUSE-SU-2020:3359-1
SLES 15 SP2 java-1_8_0-ibm 1.8.0_sr6.20-3.47.1 SUSE-SU-2020:3932-1
SLES 15 SP2 java-1_8_0-openjdk 1.8.0.272-3.42.1 SUSE-SU-2020:3460-1
SLES 15 SP1 java-11-openjdk 11.0.9.0-3.48.1 SUSE-SU-2020:3359-1
SLES 15 SP1 java-1_8_0-ibm 1.8.0_sr6.20-3.47.1 SUSE-SU-2020:3932-1
SLES 15 SP1 java-1_8_0-openjdk 1.8.0.272-3.42.1 SUSE-SU-2020:3460-1
SLES 15 java-1_8_0-ibm 1.8.0_sr6.20-3.47.1 SUSE-SU-2020:3932-1
SLES 15 java-1_8_0-openjdk 1.8.0.272-3.42.1 SUSE-SU-2020:3460-1
SLES 12 SP5 java-11-openjdk 11.0.9.0-3.15.1 SUSE-SU-2020:3159-1
SLES 12 SP5 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES 12 SP5 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES 12 SP5 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SLES 12 SP4 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES 12 SP4 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES 12 SP4 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES 12 SP4 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP3 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES 12 SP3 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES 12 SP3 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES 12 SP3 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SLES 12 SP2 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES 12 SP2 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES 12 SP2 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES 12 SP2 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SLES 11 SP4 java-1_7_1-ibm 1.7.1_sr4.75-26.62.1 SUSE-SU-2020:14588-1
SLES for SAP 15 java-1_8_0-ibm 1.8.0_sr6.20-3.47.1 SUSE-SU-2020:3932-1
SLES for SAP 15 java-1_8_0-openjdk 1.8.0.272-3.42.1 SUSE-SU-2020:3460-1
SLES for SAP 12 SP5 java-11-openjdk 11.0.9.0-3.15.1 SUSE-SU-2020:3159-1
SLES for SAP 12 SP5 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES for SAP 12 SP5 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES for SAP 12 SP5 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES for SAP 12 SP5 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SLES for SAP 12 SP4 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES for SAP 12 SP4 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES for SAP 12 SP4 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES for SAP 12 SP4 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SLES for SAP 12 SP3 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES for SAP 12 SP3 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES for SAP 12 SP3 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES for SAP 12 SP3 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SLES for SAP 12 SP2 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SLES for SAP 12 SP2 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SLES for SAP 12 SP2 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SLES for SAP 12 SP2 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE OpenStack Cloud Crowbar 9 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE OpenStack Cloud Crowbar 9 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE OpenStack Cloud Crowbar 9 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE OpenStack Cloud Crowbar 9 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE OpenStack Cloud Crowbar 8 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE OpenStack Cloud Crowbar 8 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE OpenStack Cloud Crowbar 8 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE OpenStack Cloud Crowbar 8 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE OpenStack Cloud 9 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE OpenStack Cloud 9 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE OpenStack Cloud 9 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE OpenStack Cloud 9 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE OpenStack Cloud 8 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE OpenStack Cloud 8 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE OpenStack Cloud 8 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE OpenStack Cloud 8 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE OpenStack Cloud 7 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE OpenStack Cloud 7 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE OpenStack Cloud 7 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE OpenStack Cloud 7 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE Linux Enterprise Point of Sale 11 SP3 java-1_7_0-ibm 1.7.0_sr10.75-65.57.1 SUSE-SU-2020:14587-1
SUSE HPE Helion OpenStack 8 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE HPE Helion OpenStack 8 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE HPE Helion OpenStack 8 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE HPE Helion OpenStack 8 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
SUSE Enterprise Storage 5 java-1_7_0-openjdk 1.7.0.281-43.44.2 SUSE-SU-2020:3310-1
SUSE Enterprise Storage 5 java-1_7_1-ibm 1.7.1_sr4.75-38.59.1 SUSE-SU-2021:0019-1
SUSE Enterprise Storage 5 java-1_8_0-ibm 1.8.0_sr6.20-30.78.1 SUSE-SU-2021:0032-1
SUSE Enterprise Storage 5 java-1_8_0-openjdk 1.8.0.272-27.48.1 SUSE-SU-2020:3191-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openj9 11.0.11.0-3.2 openSUSE-SU-2024:10870-1
openSUSE Tumbleweed java-11-openjdk 11.0.12.0-3.1 openSUSE-SU-2024:10871-1
openSUSE Tumbleweed java-13-openjdk 13.0.8.0-3.1 openSUSE-SU-2024:10872-1
openSUSE Tumbleweed java-15-openjdk 15.0.4.0-2.1 openSUSE-SU-2024:10873-1
openSUSE Tumbleweed java-1_8_0-openjdk 1.8.0.302-2.2 openSUSE-SU-2024:10876-1
openSUSE Leap 15.2 java-11-openjdk 11.0.9.0-lp152.2.6.2 openSUSE-SU-2020:1994-1
openSUSE Leap 15.2 java-1_8_0-openj9 1.8.0.272-lp152.3.3.1 openSUSE-SU-2020:1893-1
openSUSE Leap 15.2 java-1_8_0-openjdk 1.8.0.272-lp152.2.3.1 openSUSE-SU-2020:2083-1
openSUSE Leap 15.1 java-11-openjdk 11.0.9.0-lp151.3.22.1 openSUSE-SU-2020:1984-1
openSUSE Leap 15.1 java-1_8_0-openjdk 1.8.0.272-lp151.2.15.1 openSUSE-SU-2020:2048-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openjdk11 11.0.9_p11-r0 —
Alpine v3.24 openjdk8 8.272.10-r0 —
Alpine v3.23 openjdk11 11.0.9_p11-r0 —
Alpine v3.23 openjdk8 8.272.10-r0 —
Alpine v3.22 openjdk11 11.0.9_p11-r0 —
Alpine v3.22 openjdk8 8.272.10-r0 —
Alpine v3.21 openjdk11 11.0.9_p11-r0 —
Alpine v3.21 openjdk8 8.272.10-r0 —
Alpine v3.20 openjdk11 11.0.9_p11-r0 —
Alpine v3.20 openjdk8 8.272.10-r0 —
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 openjdk11 11.0.9_p11-r0 —
Alpine v3.19 openjdk8 8.272.10-r0 —
Alpine v3.18 openjdk11 11.0.9_p11-r0 —
Alpine v3.18 openjdk7 7.271.2.6.23-r0 —
Alpine v3.18 openjdk8 8.272.10-r0 —
Alpine v3.17 openjdk11 11.0.9_p11-r0 —
Alpine v3.17 openjdk7 7.271.2.6.23-r0 —
Alpine v3.17 openjdk8 8.272.10-r0 —
Alpine v3.16 openjdk11 11.0.9_p11-r0 —
Alpine v3.16 openjdk7 7.271.2.6.23-r0 —
Alpine v3.16 openjdk8 8.272.10-r0 —
Alpine v3.15 openjdk11 11.0.9_p11-r0 —
Alpine v3.15 openjdk7 7.271.2.6.23-r0 —
Alpine v3.15 openjdk8 8.272.10-r0 —
Alpine v3.14 openjdk11 11.0.9_p11-r0 —
Alpine v3.14 openjdk7 7.271.2.6.23-r0 —
Alpine v3.14 openjdk8 8.272.10-r0 —
Alpine v3.13 openjdk11 11.0.9_p11-r0 —
Alpine v3.13 openjdk7 7.271.2.6.23-r0 —
Alpine v3.13 openjdk8 8.272.10-r0 —
Alpine v3.12 openjdk11 11.0.9_p11-r0 —
Alpine v3.12 openjdk7 7.281.2.6.24-r0 —
Alpine v3.12 openjdk8 8.272.10-r0 —
Alpine v3.11 openjdk7 7.281.2.6.24-r0 —
Alpine v3.11 openjdk8 8.272.10-r0 —
Alpine v3.10 openjdk7 7.281.2.6.24-r0 —
Alpine v3.10 openjdk8 8.272.10-r0 —
Alpine v3.9 openjdk8 8.272.10-r0 —
Alpine v3.8 openjdk8 8.272.10-r0 —
Alpine v3.7 openjdk8 8.272.10-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 java-1.8.0-openjdk +15 1:1.8.0.272.b10-1.amzn2.0.1 ALAS2-2021-1579

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 java-1.8.0-openjdk +7 1:1.8.0.272.b10-1.el8_2 ELSA-2020-4347
Oracle Linux 8 java-11-openjdk +8 1:11.0.9.11-0.el8_2 ELSA-2020-4305
Oracle Linux 7 java-1.8.0-openjdk +7 1:1.8.0.272.b10-1.el7_9 ELSA-2020-4350
Oracle Linux 7 java-11-openjdk +8 1:11.0.9.11-0.0.1.el7_9 ELSA-2020-4307

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openjdk-10 +2 No fix yet —

Advisories 40

References