usn-3614-1
Vulnerability from osv_ubuntu
Published
2018-04-02 19:17
Modified
2026-02-10 04:41
Summary
openjdk-7 vulnerabilities
Details

It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. (CVE-2018-2579)

It was discovered that the LDAP implementation in OpenJDK did not properly encode login names. A remote attacker could possibly use this to expose sensitive information. (CVE-2018-2588)

It was discovered that the DNS client implementation in OpenJDK did not properly randomize source ports. A remote attacker could use this to spoof responses to DNS queries made by Java applications. (CVE-2018-2599)

It was discovered that the Internationalization component of OpenJDK did not restrict search paths when loading resource bundle classes. A local attacker could use this to trick a user into running malicious code. (CVE-2018-2602)

It was discovered that OpenJDK did not properly restrict memory allocations when parsing DER input. A remote attacker could possibly use this to cause a denial of service. (CVE-2018-2603)

It was discovered that the Java Cryptography Extension (JCE) implementation in OpenJDK in some situations did not guarantee sufficient strength of keys during key agreement. An attacker could use this to expose sensitive information. (CVE-2018-2618)

It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly handle GSS contexts in the native GSS library. An attacker could possibly use this to access unauthorized resources. (CVE-2018-2629)

It was discovered that the LDAP implementation in OpenJDK did not properly handle LDAP referrals in some situations. An attacker could possibly use this to expose sensitive information or gain unauthorized privileges. (CVE-2018-2633)

It was discovered that the Java GSS implementation in OpenJDK in some situations did not properly apply subject credentials. An attacker could possibly use this to expose sensitive information or gain access to unauthorized resources. (CVE-2018-2634)

It was discovered that the Java Management Extensions (JMX) component of OpenJDK did not properly apply deserialization filters in some situations. An attacker could use this to bypass deserialization restrictions. (CVE-2018-2637)

It was discovered that a use-after-free vulnerability existed in the AWT component of OpenJDK when loading the GTK library. An attacker could possibly use this to execute arbitrary code and escape Java sandbox restrictions. (CVE-2018-2641)

It was discovered that in some situations OpenJDK did not properly validate objects when performing deserialization. An attacker could use this to cause a denial of service (application crash or excessive memory consumption). (CVE-2018-2663)

It was discovered that the AWT component of OpenJDK did not properly restrict the amount of memory allocated when deserializing some objects. An attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2018-2677)

It was discovered that the JNDI component of OpenJDK did not properly restrict the amount of memory allocated when deserializing objects in some situations. An attacker could use this to cause a denial of service (excessive memory consumption). (CVE-2018-2678)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2018-2579",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2588",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2599",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2602",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2603",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2618",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2629",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2633",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2634",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2637",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2641",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2663",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2677",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-2678",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "icedtea-7-jre-jamvm",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-demo",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-jdk",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-jre",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-jre-headless",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-jre-lib",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-jre-zero",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-source",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "openjdk-7-tests",
            "binary_version": "7u171-2.6.13-0ubuntu0.14.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "openjdk-7",
        "purl": "pkg:deb/ubuntu/openjdk-7@7u171-2.6.13-0ubuntu0.14.04.2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7u171-2.6.13-0ubuntu0.14.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7u25-2.3.12-4ubuntu3",
        "7u25-2.3.12-4ubuntu5",
        "7u45-2.4.3-3ubuntu1",
        "7u45-2.4.3-3ubuntu2",
        "7u45-2.4.3-4ubuntu1",
        "7u45-2.4.3-4ubuntu2",
        "7u51-2.4.4-1ubuntu1",
        "7u51-2.4.5-1ubuntu1",
        "7u51-2.4.6~pre1-1ubuntu2",
        "7u51-2.4.6-1ubuntu3",
        "7u51-2.4.6-1ubuntu4",
        "7u55-2.4.7-1ubuntu1",
        "7u65-2.5.1-4ubuntu1~0.14.04.1",
        "7u65-2.5.1-4ubuntu1~0.14.04.2",
        "7u65-2.5.2-3~14.04",
        "7u71-2.5.3-0ubuntu0.14.04.1",
        "7u75-2.5.4-1~trusty1",
        "7u79-2.5.5-0ubuntu0.14.04.2",
        "7u79-2.5.6-0ubuntu1.14.04.1",
        "7u85-2.6.1-5ubuntu0.14.04.1",
        "7u91-2.6.3-0ubuntu0.14.04.1",
        "7u95-2.6.4-0ubuntu0.14.04.1",
        "7u95-2.6.4-0ubuntu0.14.04.2",
        "7u101-2.6.6-0ubuntu0.14.04.1",
        "7u111-2.6.7-0ubuntu0.14.04.3",
        "7u121-2.6.8-1ubuntu0.14.04.1",
        "7u121-2.6.8-1ubuntu0.14.04.3",
        "7u131-2.6.9-0ubuntu0.14.04.1",
        "7u131-2.6.9-0ubuntu0.14.04.2",
        "7u151-2.6.11-0ubuntu1.14.04.1",
        "7u151-2.6.11-2ubuntu0.14.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that a race condition existed in the cryptography\nimplementation in OpenJDK. An attacker could possibly use this to expose\nsensitive information. (CVE-2018-2579)\n\nIt was discovered that the LDAP implementation in OpenJDK did not properly\nencode login names. A remote attacker could possibly use this to expose\nsensitive information. (CVE-2018-2588)\n\nIt was discovered that the DNS client implementation in OpenJDK did not\nproperly randomize source ports. A remote attacker could use this to spoof\nresponses to DNS queries made by Java applications. (CVE-2018-2599)\n\nIt was discovered that the Internationalization component of OpenJDK did\nnot restrict search paths when loading resource bundle classes. A local\nattacker could use this to trick a user into running malicious code.\n(CVE-2018-2602)\n\nIt was discovered that OpenJDK did not properly restrict memory allocations\nwhen parsing DER input. A remote attacker could possibly use this to cause\na denial of service. (CVE-2018-2603)\n\nIt was discovered that the Java Cryptography Extension (JCE) implementation\nin OpenJDK in some situations did not guarantee sufficient strength of keys\nduring key agreement. An attacker could use this to expose sensitive\ninformation. (CVE-2018-2618)\n\nIt was discovered that the Java GSS implementation in OpenJDK in some\nsituations did not properly handle GSS contexts in the native GSS library.\nAn attacker could possibly use this to access unauthorized resources.\n(CVE-2018-2629)\n\nIt was discovered that the LDAP implementation in OpenJDK did not properly\nhandle LDAP referrals in some situations. An attacker could possibly use\nthis to expose sensitive information or gain unauthorized privileges.\n(CVE-2018-2633)\n\nIt was discovered that the Java GSS implementation in OpenJDK in some\nsituations did not properly apply subject credentials. An attacker could\npossibly use this to expose sensitive information or gain access to\nunauthorized resources. (CVE-2018-2634)\n\nIt was discovered that the Java Management Extensions (JMX) component of\nOpenJDK did not properly apply deserialization filters in some situations.\nAn attacker could use this to bypass deserialization restrictions.\n(CVE-2018-2637)\n\nIt was discovered that a use-after-free vulnerability existed in the AWT\ncomponent of OpenJDK when loading the GTK library. An attacker could\npossibly use this to execute arbitrary code and escape Java sandbox\nrestrictions. (CVE-2018-2641)\n\nIt was discovered that in some situations OpenJDK did not properly validate\nobjects when performing deserialization. An attacker could use this to\ncause a denial of service (application crash or excessive memory\nconsumption). (CVE-2018-2663)\n\nIt was discovered that the AWT component of OpenJDK did not properly\nrestrict the amount of memory allocated when deserializing some objects. An\nattacker could use this to cause a denial of service (excessive memory\nconsumption). (CVE-2018-2677)\n\nIt was discovered that the JNDI component of OpenJDK did not properly\nrestrict the amount of memory allocated when deserializing objects in some\nsituations. An attacker could use this to cause a denial of service\n(excessive memory consumption). (CVE-2018-2678)\n",
  "id": "USN-3614-1",
  "modified": "2026-02-10T04:41:17Z",
  "published": "2018-04-02T19:17:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3614-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2579"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2588"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2599"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2602"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2603"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2618"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2629"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2633"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2634"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2637"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2641"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2663"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2677"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-2678"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "openjdk-7 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2018-2579",
    "UBUNTU-CVE-2018-2588",
    "UBUNTU-CVE-2018-2599",
    "UBUNTU-CVE-2018-2602",
    "UBUNTU-CVE-2018-2603",
    "UBUNTU-CVE-2018-2618",
    "UBUNTU-CVE-2018-2629",
    "UBUNTU-CVE-2018-2633",
    "UBUNTU-CVE-2018-2634",
    "UBUNTU-CVE-2018-2637",
    "UBUNTU-CVE-2018-2641",
    "UBUNTU-CVE-2018-2663",
    "UBUNTU-CVE-2018-2677",
    "UBUNTU-CVE-2018-2678"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.