Ubuntu USN-4083-1: OpenJDK 11 Security Fixes for CVE-2019-2763, 2769, 2786

Critical Vulnerability Information Vulnerability Notification USN ID: USN-4083-1 Release Date: July 31, 2019 Summary: Fixes multiple security issues in OpenJDK 11 Vulnerability Details 1. CVE-2019-2763: OpenJDK insufficiently validates serialized streams, potentially leading to memory limit exceedance during serialization, causing a denial of service. 2. CVE-2019-2769: OpenJDK fails to properly restrict memory allocation in certain cases, potentially leading to denial of service (excessive memory consumption). 3. CVE-2019-2786: OpenJDK fails to properly restrict privileges in certain cases, allowing untrusted Java applications or applets to bypass sandbox restrictions. Update Instructions Uses a new upstream release, including additional bug fixes. After standard system updates, any Java applications must be restarted to apply all necessary changes. The issue is resolved by updating to the following versions: - Ubuntu 19.04 disco: - openjdk-11-jdk - 11.0.4+11-1ubuntu2~19.04 - openjdk-11-jdk-headless - 11.0.4+11-1ubuntu2~19.04 - openjdk-11-jre - 11.0.4+11-1ubuntu2~19.04 - openjdk-11-jre-headless - 11.0.4+11-1ubuntu2~19.04 - openjdk-11-jre-zero - 11.0.4+11-1ubuntu2~19.04 - Ubuntu 18.04 LTS bionic: - openjdk-11-jdk - 11.0.4+11-1ubuntu2~18.04.3 - openjdk-11-jdk-headless - 11.0.4+11-1ubuntu2~18.04.3 - openjdk-11-jre - 11.0.4+11-1ubuntu2~18.04.3 - openjdk-11-jre-headless - 11.0.4+11-1ubuntu2~18.04.3 - openjdk-11-jre-zero - 11.0.4+11-1ubuntu2~18.04.3 References CVE-2019-7317 CVE-2019-2821 CVE-2019-2818 CVE-2019-2816 CVE-2019-2786 CVE-2019-2769 CVE-2019-2762 Related Notifications USN-4080-1 USN-3997-1 USN-3991-1 USN-3962-1

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-4083-1: OpenJDK 11 Security Fixes for CVE-2019-2763, 2769, 2786