Description
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | Java SE JDK and JRE | Oracle Java SE:8u381, Oracle Java SE:8u381-perf, Oracle GraalVM Enterprise Edition:20.3.11, Oracle GraalVM Enterprise Edition:21.3.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | openjdk-18 | No fix yet | — |
| Ubuntu 22.04 LTS | openjdk-8 | 8u392-ga-1~22.04 | USN-6528-1 |
| Ubuntu 20.04 LTS | openjdk-13 +1 | No fix yet | — |
| Ubuntu 20.04 LTS | openjdk-8 | 8u392-ga-1~20.04 | USN-6528-1 |
| Ubuntu 16.04 LTS | openjdk-9 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | openjdk-8 | 8u392-ga-1~18.04 | USN-6528-1 |
| Ubuntu Pro 16.04 LTS | openjdk-8 | 8u392-ga-1~16.04 | USN-6528-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | java-1.8.0-openjdk +16 | 1:1.8.0.392.b08-3.el9 | RHSA-2023:5733 |
| RHEL 8 | java-1.8.0-ibm +7 | 1:1.8.0.8.15-1.el8_9 | RHSA-2024:0866 |
| RHEL 8 | java-1.8.0-openjdk +19 | 1:1.8.0.392.b08-4.el8 | RHSA-2023:5731 |
| RHEL 7 | java-1.8.0-ibm +5 | 1:1.8.0.8.15-1jpp.1.el7 | RHSA-2024:0879 |
| RHEL 7 | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el7_9 | RHSA-2023:5761 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 EUS | java-1.8.0-openjdk +16 | 1:1.8.0.392.b08-2.el9_0 | RHSA-2023:5732 |
| RHEL 8.6 EUS | java-1.8.0-openjdk +19 | 1:1.8.0.392.b08-2.el8_6 | RHSA-2023:5730 |
| RHEL 8.4 TUS | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_4 | RHSA-2023:5729 |
| RHEL 8.4 E4S | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_4 | RHSA-2023:5729 |
| RHEL 8.4 AUS | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_4 | RHSA-2023:5729 |
| RHEL 8.2 TUS | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_2 | RHSA-2023:5728 |
| RHEL 8.2 E4S | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_2 | RHSA-2023:5728 |
| RHEL 8.2 AUS | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_2 | RHSA-2023:5728 |
| RHEL 8.1 E4S | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el8_1 | RHSA-2023:5727 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | java-1.8.0-openjdk +16 | 1:1.8.0.392.b08-3.el9 | ALSA-2023:5733 |
| AlmaLinux 8 | java-1.8.0-openjdk +19 | 1:1.8.0.392.b08-4.el8 | ALSA-2023:5731 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES 15 SP5 | java-1_8_0-openj9 | 1.8.0.392-150200.3.39.1 | SUSE-SU-2023:4612-1 |
| SLES 15 SP5 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES 15 SP4 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES 15 SP4 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES 15 SP3 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES 15 SP3 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES 15 SP2 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES 15 SP2 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES 15 SP1 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES 15 SP1 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | java-1_8_0-ibm | 1.8.0_sr8.15-30.117.1 | SUSE-SU-2023:4614-1 |
| SLES 12 SP5 | java-1_8_0-openjdk | 1.8.0.392-27.93.1 | SUSE-SU-2023:4507-1 |
| SLES for SAP 15 SP3 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES for SAP 15 SP3 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES for SAP 15 SP2 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES for SAP 15 SP2 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES for SAP 15 SP1 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLES for SAP 15 SP1 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SLES for SAP 12 SP5 | java-1_8_0-ibm | 1.8.0_sr8.15-30.117.1 | SUSE-SU-2023:4614-1 |
| SLES for SAP 12 SP5 | java-1_8_0-openjdk | 1.8.0.392-27.93.1 | SUSE-SU-2023:4507-1 |
| SLE HPC 15 SP3 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SLE HPC 15 SP3 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| SUSE Enterprise Storage 7.1 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| SUSE Enterprise Storage 7.1 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_8_0-openj9 +1 | 1.8.0.392-1.1 | openSUSE-SU-2024:13457-1, openSUSE-SU-2024:13421-1 |
| openSUSE Leap 15.5 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| openSUSE Leap 15.5 | java-1_8_0-openj9 | 1.8.0.392-150200.3.39.1 | SUSE-SU-2023:4612-1 |
| openSUSE Leap 15.5 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
| openSUSE Leap 15.4 | java-1_8_0-ibm | 1.8.0_sr8.15-150000.3.83.1 | SUSE-SU-2023:4572-1 |
| openSUSE Leap 15.4 | java-1_8_0-openj9 | 1.8.0.392-150200.3.39.1 | SUSE-SU-2023:4612-1 |
| openSUSE Leap 15.4 | java-1_8_0-openjdk | 1.8.0.392-150000.3.85.1 | SUSE-SU-2023:4506-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.23 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.22 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.21 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.20 | openjdk8 | 8.392.08-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.18 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.17 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.16 | openjdk8 | 8.392.08-r0 | — |
| Alpine v3.15 | openjdk8 | 8.392.08-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | java-1.8.0-amazon-corretto +1 | 1:1.8.0_392.b08-1.amzn2023 | ALAS2023-2023-426, ALAS2023-2023-398 |
| Amazon Linux 2 | java-1.8.0-openjdk +15 | 1:1.8.0.392.b08-2.amzn2.0.1 | ALAS2-2024-2397 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | graalvm-community-17-jdk +1 | 17.0.9-1.el9 | ELSA-2023-12944, ELSA-2023-12943 |
| Oracle Linux 9 | graalvm-community-17-llvm +17 | 23.0.2-1.el9 | ELSA-2023-12944, ELSA-2023-12943 |
| Oracle Linux 9 | graalvm-community-21-jdk +1 | 21.0.1-1.el9 | ELSA-2023-12942, ELSA-2023-12941 |
| Oracle Linux 9 | java-1.8.0-openjdk +16 | 1:1.8.0.392.b08-3.0.1.el9 | ELSA-2023-5733 |
| Oracle Linux 8 | graalvm-community-17-jdk +1 | 17.0.9-1.el8 | ELSA-2023-12940, ELSA-2023-12939 |
| Oracle Linux 8 | graalvm-community-17-llvm +17 | 23.0.2-1.el8 | ELSA-2023-12940, ELSA-2023-12939 |
| Oracle Linux 8 | graalvm-community-21-jdk +1 | 21.0.1-1.el8 | ELSA-2023-12938, ELSA-2023-12937 |
| Oracle Linux 8 | java-1.8.0-openjdk +19 | 1:1.8.0.392.b08-4.0.1.el8 | ELSA-2023-5731 |
| Oracle Linux 7 | graalvm-community-17-jdk +1 | 17.0.9-1.el7 | ELSA-2023-12935, ELSA-2023-12933 |
| Oracle Linux 7 | graalvm-community-17-llvm +17 | 23.0.2-1.el7 | ELSA-2023-12935, ELSA-2023-12933 |
| Oracle Linux 7 | graalvm-community-21-jdk +1 | 21.0.1-1.el7 | ELSA-2023-12936, ELSA-2023-12934 |
| Oracle Linux 7 | java-1.8.0-openjdk +7 | 1:1.8.0.392.b08-2.el7_9 | ELSA-2023-5761 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openjdk-7 | No fix yet | — |
Advisories 43
- ALSA-2023:5733 Moderate: java-1.8.0-openjdk security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:5731 Moderate: java-1.8.0-openjdk security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:0879 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2024:0866 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5761 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5732 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5733 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5730 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5731 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5728 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5729 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2023:5727 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- USN-6528-1 openjdk-8 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2023:4507-1 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13421-1 java-1_8_0-openjdk-1.8.0.392-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4612-1 Security update for java-1_8_0-openj9 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4614-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13457-1 java-1_8_0-openj9-1.8.0.392-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4506-1 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2692 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- SUSE-SU-2023:4572-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- WID-SEC-2024-0769 IBM Rational Build Forge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 7, 2024
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- ALAS2-2024-2397 Moderate: java-1.8.0-openjdk security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 9, 2024
- ALAS2023-2023-426 Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2023
- ELSA-2023-5733 Moderate: java-1.8.0-openjdk security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 2, 2023
- ELSA-2023-5731 Moderate: java-1.8.0-openjdk security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 2, 2023
- ALAS2023-2023-398 Moderate: java-1.8.0-amazon-corretto security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 24, 2023
- ELSA-2023-12941 Important: GraalVM Security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12935 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12939 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12936 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12940 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12934 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12937 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12943 Important: GraalVM Security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12942 Important: GraalVM Security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12938 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12944 Important: GraalVM Security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-12933 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 24, 2023
- ELSA-2023-5761 Moderate: java-1.8.0-openjdk security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 19, 2023