Candidate: CVE-2019-2958
PublicDate: 2019-10-16 18:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2958
 http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Description:
 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE
 (component: Libraries). Supported versions that are affected are Java SE:
 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit
 vulnerability allows unauthenticated attacker with network access via
 multiple protocols to compromise Java SE, Java SE Embedded. Successful
 attacks of this vulnerability can result in unauthorized creation, deletion
 or modification access to critical data or all Java SE, Java SE Embedded
 accessible data. Note: This vulnerability applies to Java deployments,
 typically in clients running sandboxed Java Web Start applications or
 sandboxed Java applets (in Java SE 8), that load and run untrusted code
 (e.g., code that comes from the internet) and rely on the Java sandbox for
 security. This vulnerability can also be exploited by using APIs in the
 specified Component, e.g., through a web service which supplies data to the
 APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector:
 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Ubuntu-Description:
Notes:
 sbeattie> Windows only
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N [5.9 MEDIUM]


Patches_openjdk-7:
upstream_openjdk-7: not-affected (windows only)
precise/esm_openjdk-7: DNE
trusty_openjdk-7: ignored (out of standard support)
trusty/esm_openjdk-7: DNE
xenial_openjdk-7: DNE
bionic_openjdk-7: DNE
disco_openjdk-7: DNE
eoan_openjdk-7: DNE
devel_openjdk-7: DNE

Patches_openjdk-lts:
 upstream: http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/a2ddb1a585cf
upstream_openjdk-lts: released (11.0.5+10-1)
precise/esm_openjdk-lts: DNE
trusty_openjdk-lts: ignored (out of standard support)
trusty/esm_openjdk-lts: DNE
xenial_openjdk-lts: DNE
bionic_openjdk-lts: not-affected (windows only)
disco_openjdk-lts: not-affected (windows only)
eoan_openjdk-lts: not-affected (windows only)
devel_openjdk-lts: not-affected (windows only)

Patches_openjdk-8:
upstream_openjdk-8: not-affected (windows only)
precise/esm_openjdk-8: DNE
trusty_openjdk-8: ignored (out of standard support)
trusty/esm_openjdk-8: DNE
xenial_openjdk-8: not-affected (windows only)
esm-infra/xenial_openjdk-8: not-affected (windows only)
bionic_openjdk-8: not-affected (windows only)
disco_openjdk-8: not-affected (windows only)
eoan_openjdk-8: not-affected (windows only)
devel_openjdk-8: not-affected (windows only)

Patches_openjdk-12:
upstream_openjdk-12: not-affected (windows only)
precise/esm_openjdk-12: DNE
trusty_openjdk-12: DNE
trusty/esm_openjdk-12: DNE
xenial_openjdk-12: DNE
bionic_openjdk-12: DNE
disco_openjdk-12: not-affected (windows only)
eoan_openjdk-12: DNE
devel_openjdk-12: DNE

Patches_openjdk-13:
upstream_openjdk-13: not-affected (windows only)
precise/esm_openjdk-13: DNE
trusty_openjdk-13: DNE
trusty/esm_openjdk-13: DNE
xenial_openjdk-13: DNE
bionic_openjdk-13: DNE
disco_openjdk-13: not-affected (windows only)
eoan_openjdk-13: not-affected (windows only)
devel_openjdk-13: not-affected (windows only)