Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 20: [bsc#1219843] Security fixes: - CVE-2023-33850: Fixed information disclosure vulnerability due to the consumed GSKit library (bsc#1219843). - CVE-2024-20932: Fixed incorrect handling of ZIP files with duplicate entries (bsc#1218908). - CVE-2024-20952: Fixed RSA padding issue and timing side-channel attack against TLS (bsc#1218911). - CVE-2024-20918: Fixed array out-of-bounds access due to missing range check in C1 compiler (bsc#1218907). - CVE-2024-20921: Fixed range check loop optimization issue (bsc#1218905). - CVE-2024-20919: Fixed JVM class file verifier flaw allows unverified bytecode execution (bsc#1218903). - CVE-2024-20926: Fixed arbitrary Java code execution in Nashorn (bsc#1218906). - CVE-2024-20945: Fixed logging of digital signature private keys (bsc#1218909).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for java-1_8_0-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 20: [bsc#1219843] Security fixes: - CVE-2023-33850: Fixed information disclosure vulnerability due to the consumed GSKit library (bsc#1219843). - CVE-2024-20932: Fixed incorrect handling of ZIP files with duplicate entries (bsc#1218908). - CVE-2024-20952: Fixed RSA padding issue and timing side-channel attack against TLS (bsc#1218911). - CVE-2024-20918: Fixed array out-of-bounds access due to missing range check in C1 compiler (bsc#1218907). - CVE-2024-20921: Fixed range check loop optimization issue (bsc#1218905). - CVE-2024-20919: Fixed JVM class file verifier flaw allows unverified bytecode execution (bsc#1218903). - CVE-2024-20926: Fixed arbitrary Java code execution in Nashorn (bsc#1218906). - CVE-2024-20945: Fixed logging of digital signature private keys (bsc#1218909).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1218903
- https://bugzilla.suse.com/1218905
- https://bugzilla.suse.com/1218906
- https://bugzilla.suse.com/1218907
- https://bugzilla.suse.com/1218908
- https://bugzilla.suse.com/1218909
- https://bugzilla.suse.com/1218911
- https://bugzilla.suse.com/1219843
- https://www.suse.com/security/cve/CVE-2023-33850
- https://www.suse.com/security/cve/CVE-2024-20918
- https://www.suse.com/security/cve/CVE-2024-20919
- https://www.suse.com/security/cve/CVE-2024-20921
- https://www.suse.com/security/cve/CVE-2024-20926
- https://www.suse.com/security/cve/CVE-2024-20932
- https://www.suse.com/security/cve/CVE-2024-20945
- https://www.suse.com/security/cve/CVE-2024-20952
- https://www.suse.com/support/update/announcement/2024/suse-su-20240619-1/