USN-6929-1: OpenJDK 8 vulnerabilities
31 July 2024
Several security issues were fixed in OpenJDK 8.
Releases
Packages
- openjdk-8 - Open Source Java implementation
Details
It was discovered that the Hotspot component of OpenJDK 8 was not properly
performing bounds when handling certain UTF-8 strings, which could lead to
a buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2024-21131)
It was discovered that the Hotspot component of OpenJDK 8 could be made to
run into an infinite loop. If an automated system were tricked into
processing excessively large symbols, an attacker could possibly use this
issue to cause a denial of service. (CVE-2024-21138)
It was discovered that the Hotspot component of OpenJDK 8 did not properly
perform range check elimination. An attacker could possibly use this issue
to cause a denial of service, execute arbitrary code or bypass Java
sandbox restrictions. (CVE-2024-21140)
Yakov Shafranovich discovered that the Concurrency component of OpenJDK 8
incorrectly performed header validation in the Pack200 archive format. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2024-21144)
Sergey Bylokhov discovered that OpenJDK 8 did not properly manage memory
when handling 2D images. An attacker could possibly use this issue to
obtain sensitive information. (CVE-2024-21145)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled memory when performing range check elimination under certain
circumstances. An attacker could possibly use this issue to cause a
denial of service, execute arbitrary code or bypass Java sandbox
restrictions. (CVE-2024-21147)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.04
-
openjdk-8-jdk
-
8u422-b05-1~24.04
-
openjdk-8-jdk-headless
-
8u422-b05-1~24.04
-
openjdk-8-jre
-
8u422-b05-1~24.04
-
openjdk-8-jre-headless
-
8u422-b05-1~24.04
-
openjdk-8-jre-zero
-
8u422-b05-1~24.04
Ubuntu 22.04
-
openjdk-8-jdk
-
8u422-b05-1~22.04
-
openjdk-8-jdk-headless
-
8u422-b05-1~22.04
-
openjdk-8-jre
-
8u422-b05-1~22.04
-
openjdk-8-jre-headless
-
8u422-b05-1~22.04
-
openjdk-8-jre-zero
-
8u422-b05-1~22.04
Ubuntu 20.04
-
openjdk-8-jdk
-
8u422-b05-1~20.04
-
openjdk-8-jdk-headless
-
8u422-b05-1~20.04
-
openjdk-8-jre
-
8u422-b05-1~20.04
-
openjdk-8-jre-headless
-
8u422-b05-1~20.04
-
openjdk-8-jre-zero
-
8u422-b05-1~20.04
Ubuntu 18.04
-
openjdk-8-jdk
-
8u422-b05-1~18.04
Available with Ubuntu Pro
-
openjdk-8-jdk-headless
-
8u422-b05-1~18.04
Available with Ubuntu Pro
-
openjdk-8-jre
-
8u422-b05-1~18.04
Available with Ubuntu Pro
-
openjdk-8-jre-headless
-
8u422-b05-1~18.04
Available with Ubuntu Pro
-
openjdk-8-jre-zero
-
8u422-b05-1~18.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
Related notices
- USN-6930-1: openjdk-11-jdk-headless, openjdk-11-jdk, openjdk-11-source, openjdk-11-demo, openjdk-11-jre-headless, openjdk-11-jre-zero, openjdk-11-jre, openjdk-11-doc, openjdk-lts
- USN-6932-1: openjdk-21-jre-headless, openjdk-21-doc, openjdk-21-demo, openjdk-21-jre, openjdk-21-testsupport, openjdk-21, openjdk-21-source, openjdk-21-jdk-headless, openjdk-21-jdk, openjdk-21-jre-zero
- USN-6931-1: openjdk-17-demo, openjdk-17-jre, openjdk-17-jdk, openjdk-17-doc, openjdk-17-jre-headless, openjdk-17-source, openjdk-17, openjdk-17-jdk-headless, openjdk-17-jre-zero