gentoo-overlay/metadata/glsa/glsa-202209-15.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="202209-15">
    <title>Oracle JDK/JRE: Multiple vulnerabilities</title>
    <synopsis>Multiple vulnerabilities have been found in Oracle JDK and JRE, the worst of which could result in the arbitrary execution of code.</synopsis>
    <product type="ebuild">oracle-jdk-bin,oracle-jre-bin</product>
    <announced>2022-09-25</announced>
    <revised count="1">2022-09-25</revised>
    <bug>732630</bug>
    <bug>717638</bug>
    <access>remote</access>
    <affected>
        <package name="dev-java/oracle-jdk-bin" auto="yes" arch="*">
            <vulnerable range="le">11.0.2</vulnerable>
        </package>
        <package name="dev-java/oracle-jre-bin" auto="yes" arch="*">
            <vulnerable range="le">1.8.0.202</vulnerable>
        </package>
    </affected>
    <background>
        <p>Java Platform, Standard Edition (Java SE) lets you develop and deploy Java applications on desktops and servers, as well as in today&#39;s demanding embedded environments. Java offers the rich user interface, performance, versatility, portability, and security that today&#39;s applications require.</p>
    </background>
    <description>
        <p>Multiple vulnerabilities have been discovered in Oracle&#39;s JDK and JRE software suites. Please review the CVE identifiers referenced below for details.</p>
    </description>
    <impact type="normal">
        <p>Certain uses of untrusted data by Oracle JDK and JRE could result in arbitrary code execution.</p>
    </impact>
    <workaround>
        <p>There is no known workaround at this time.</p>
    </workaround>
    <resolution>
        <p>Gentoo has discontinued support for the Oracle JDK and JRE. We recommend that users remove it, and use dev-java/openjdk, dev-java/openjdk-bin, or dev-java/openjdk-jre-bin instead:</p>
        
        <code>
          # emerge --ask --depclean "dev-java/oracle-jre-bin"
          # emerge --ask --depclean "dev-java/oracle-jdk-bin"
        </code>
    </resolution>
    <references>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2585">CVE-2020-2585</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2755">CVE-2020-2755</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2756">CVE-2020-2756</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2757">CVE-2020-2757</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2773">CVE-2020-2773</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2781">CVE-2020-2781</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2800">CVE-2020-2800</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2803">CVE-2020-2803</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-2805">CVE-2020-2805</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14556">CVE-2020-14556</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14562">CVE-2020-14562</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14573">CVE-2020-14573</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14577">CVE-2020-14577</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14578">CVE-2020-14578</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14579">CVE-2020-14579</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14581">CVE-2020-14581</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14583">CVE-2020-14583</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14593">CVE-2020-14593</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14621">CVE-2020-14621</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-14664">CVE-2020-14664</uri>
    </references>
    <metadata tag="requester" timestamp="2022-09-25T13:36:11.652902Z">ajak</metadata>
    <metadata tag="submitter" timestamp="2022-09-25T13:36:11.657278Z">ajak</metadata>
</glsa>