{"cves":[{"id":"CVE-2020-13847","published":"2020-07-14T18:15:00","updated_at":"2025-07-11T07:43:23.884634+00:00","description":"\nSylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check.\nSingularity's sign and verify commands do not sign metadata found in the\nglobal header or data object descriptors of a SIF file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v","https://medium.com/sylabs","https://www.cve.org/CVERecord?id=CVE-2020-13847"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965040"],"patches":{"singularity-container":[]},"tags":{},"packages":[{"name":"singularity-container","source":"https://ubuntu.com/security/cve?package=singularity-container","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=singularity-container","debian":"https://tracker.debian.org/pkg/singularity-container","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-13846","published":"2020-07-14T18:15:00","updated_at":"2025-07-11T07:43:23.884634+00:00","description":"\nSylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status\nCode.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/hpcng/singularity/security/advisories/GHSA-6w7g-p4jh-rf92","https://medium.com/sylabs","https://www.cve.org/CVERecord?id=CVE-2020-13846"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965040"],"patches":{"singularity-container":[]},"tags":{},"packages":[{"name":"singularity-container","source":"https://ubuntu.com/security/cve?package=singularity-container","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=singularity-container","debian":"https://tracker.debian.org/pkg/singularity-container","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-13845","published":"2020-07-14T18:15:00","updated_at":"2025-07-11T07:43:23.884634+00:00","description":"\nSylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity\nCheck Value. Image integrity is not validated when an ECL policy is\nenforced. The fingerprint required by the ECL is compared against the\nsignature object descriptor(s) in the SIF file, rather than to a\ncryptographically validated signature.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c","https://medium.com/sylabs","https://www.cve.org/CVERecord?id=CVE-2020-13845"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965040"],"patches":{"singularity-container":[]},"tags":{},"packages":[{"name":"singularity-container","source":"https://ubuntu.com/security/cve?package=singularity-container","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=singularity-container","debian":"https://tracker.debian.org/pkg/singularity-container","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-13935","published":"2020-07-14T15:15:00","updated_at":"2026-06-03T14:18:27.816197+00:00","description":"\nThe payload length in a WebSocket frame was not correctly validated in\nApache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56\nand 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite\nloop. Multiple requests with invalid payload lengths could lead to a denial\nof service.","ubuntu_description":"","notes":[{"author":"ebarretto","note":"bionic tomcat7 only builds libservlet3.0-java, not the Tomcat server binaries"}],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2020/07/14/3","https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E","https://ubuntu.com/security/notices/USN-4448-1","https://ubuntu.com/security/notices/USN-4596-1","https://www.cve.org/CVERecord?id=CVE-2020-13935"],"bugs":[""],"patches":{"tomcat6":[],"tomcat7":["upstream: https://github.com/apache/tomcat/commit/f9f75c14678b68633f79030ddf4ff827f014cc84","upstream: https://github.com/apache/tomcat/commit/4c04982870d6e730c38e21e58fb653b7cf723784"],"tomcat8":["upstream: https://github.com/apache/tomcat/commit/12d715676038efbf9c728af10163f8277fc019d5"],"tomcat9":["upstream: https://github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357926723d"]},"tags":{},"packages":[{"name":"tomcat7","source":"https://ubuntu.com/security/cve?package=tomcat7","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat7","debian":"https://tracker.debian.org/pkg/tomcat7","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"7.0.105","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"see notes","component":null,"pocket":"security"}]},{"name":"tomcat6","source":"https://ubuntu.com/security/cve?package=tomcat6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat6","debian":"https://tracker.debian.org/pkg/tomcat6","statuses":[{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"tomcat8","source":"https://ubuntu.com/security/cve?package=tomcat8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat8","debian":"https://tracker.debian.org/pkg/tomcat8","statuses":[{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8.0.32-1ubuntu1.13","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"8.5.57","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"tomcat9","source":"https://ubuntu.com/security/cve?package=tomcat9","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat9","debian":"https://tracker.debian.org/pkg/tomcat9","statuses":[{"release_codename":"focal","status":"released","description":"9.0.31-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"9.0.37","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"}]}],"notices_ids":["USN-4448-1","USN-4596-1"],"notices":[{"id":"USN-4448-1","title":"Tomcat vulnerabilities","summary":"Several security issues were fixed in Tomcat.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2020-08-04T16:56:27.111895","description":"It was discovered that Tomcat incorrectly validated the payload length in\na WebSocket frame. A remote attacker could possibly use this issue to cause\nTomcat to hang, resulting in a denial of service. (CVE-2020-13935)\n\nIt was discovered that Tomcat incorrectly handled HTTP header parsing. In\ncertain environments where Tomcat is located behind a reverse proxy, a\nremote attacker could possibly use this issue to perform HTTP Reqest\nSmuggling. (CVE-2020-1935)\n\nIt was discovered that Tomcat incorrectly handled certain uncommon\nPersistenceManager with FileStore configurations. A remote attacker could\npossibly use this issue to execute arbitrary code. (CVE-2020-9484)\n","is_hidden":false,"release_packages":{"xenial":[{"name":"tomcat8","version":"8.0.32-1ubuntu1.13","description":"Servlet and JSP engine","is_source":true},{"name":"libservlet3.1-java","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"libservlet3.1-java-doc","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"libtomcat8-java","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"tomcat8","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"tomcat8-admin","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"tomcat8-common","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"tomcat8-docs","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"tomcat8-examples","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"},{"name":"tomcat8-user","version":"8.0.32-1ubuntu1.13","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat8","version_link":"https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-13935","CVE-2020-1935","CVE-2020-9484"]},{"id":"USN-4596-1","title":"Tomcat vulnerabilities","summary":"Several security issues were fixed in Tomcat.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2020-10-21T13:55:35.590369","description":"It was discovered that Tomcat did not properly manage HTTP/2 streams. An \nattacker could possibly use this to cause Tomcat to consume resources, \nresulting in a denial of service. (CVE-2020-11996)\n\nIt was discovered that Tomcat did not properly release the HTTP/1.1 \nprocessor after the upgrade to HTTP/2. An attacker could possibly use this\nto generate an OutOfMemoryException, resulting in a denial of service. \n(CVE-2020-13934)\n\nIt was discovered that Tomcat did not properly validate the payload length\nin a WebSocket frame. An attacker could possibly use this to trigger an\ninfinite loop, resulting in a denial of service. (CVE-2020-13935)\n\nIt was discovered that Tomcat did not properly deserialize untrusted data.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-9484)\n","is_hidden":false,"release_packages":{"focal":[{"name":"tomcat9","version":"9.0.31-1ubuntu0.1","description":"Apache Tomcat 9 - Servlet and JSP engine","is_source":true},{"name":"libtomcat9-embed-java","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"libtomcat9-java","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-admin","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-common","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-docs","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-examples","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-user","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-9484","CVE-2020-13934","CVE-2020-11996","CVE-2020-13935"]}]},{"id":"CVE-2020-13934","published":"2020-07-14T15:15:00","updated_at":"2025-08-21T17:01:20.254213+00:00","description":"\nAn h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5\nto 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after\nthe upgrade to HTTP/2. If a sufficient number of such requests were made,\nan OutOfMemoryException could occur leading to a denial of service.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2020/07/14/4","https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","https://ubuntu.com/security/notices/USN-4596-1","https://www.cve.org/CVERecord?id=CVE-2020-13934"],"bugs":[""],"patches":{"tomcat6":[],"tomcat7":[],"tomcat8":["upstream: https://github.com/apache/tomcat/commit/923d834500802a61779318911d7898bd85fc950e"],"tomcat9":["upstream: https://github.com/apache/tomcat/commit/172977f04a5215128f1e278a688983dcd230f399"]},"tags":{},"packages":[{"name":"tomcat6","source":"https://ubuntu.com/security/cve?package=tomcat6","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat6","debian":"https://tracker.debian.org/pkg/tomcat6","statuses":[{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"tomcat7","source":"https://ubuntu.com/security/cve?package=tomcat7","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat7","debian":"https://tracker.debian.org/pkg/tomcat7","statuses":[{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"tomcat8","source":"https://ubuntu.com/security/cve?package=tomcat8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat8","debian":"https://tracker.debian.org/pkg/tomcat8","statuses":[{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"mantic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"oracular","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"8.5.57","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"tomcat9","source":"https://ubuntu.com/security/cve?package=tomcat9","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=tomcat9","debian":"https://tracker.debian.org/pkg/tomcat9","statuses":[{"release_codename":"kinetic","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"9.0.31-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"9.0.37","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"9.0.37-3","component":null,"pocket":"security"}]}],"notices_ids":["USN-4596-1"],"notices":[{"id":"USN-4596-1","title":"Tomcat vulnerabilities","summary":"Several security issues were fixed in Tomcat.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2020-10-21T13:55:35.590369","description":"It was discovered that Tomcat did not properly manage HTTP/2 streams. An \nattacker could possibly use this to cause Tomcat to consume resources, \nresulting in a denial of service. (CVE-2020-11996)\n\nIt was discovered that Tomcat did not properly release the HTTP/1.1 \nprocessor after the upgrade to HTTP/2. An attacker could possibly use this\nto generate an OutOfMemoryException, resulting in a denial of service. \n(CVE-2020-13934)\n\nIt was discovered that Tomcat did not properly validate the payload length\nin a WebSocket frame. An attacker could possibly use this to trigger an\ninfinite loop, resulting in a denial of service. (CVE-2020-13935)\n\nIt was discovered that Tomcat did not properly deserialize untrusted data.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-9484)\n","is_hidden":false,"release_packages":{"focal":[{"name":"tomcat9","version":"9.0.31-1ubuntu0.1","description":"Apache Tomcat 9 - Servlet and JSP engine","is_source":true},{"name":"libtomcat9-embed-java","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"libtomcat9-java","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-admin","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-common","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-docs","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-examples","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"},{"name":"tomcat9-user","version":"9.0.31-1ubuntu0.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/tomcat9","version_link":"https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-9484","CVE-2020-13934","CVE-2020-11996","CVE-2020-13935"]}]},{"id":"CVE-2020-15720","published":"2020-07-14T14:15:00","updated_at":"2025-08-25T23:21:35.931627+00:00","description":"\nIn Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not\nenable python-requests certificate validation. Since the verify parameter\nwas hard-coded in all request functions, it was not possible to override\nthe setting. As a result, tools making use of this class, such as the\npki-server command, may have been vulnerable to Person-in-the-Middle\nattacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.","ubuntu_description":"","notes":[{"author":"avital","note":"The CVE fix changes the API with the potential to break software which\ncalls dogtag-pki under certain circumstances. If the fix is backported, the\nfreeipa package must also be updated silmitaniously with\nhttps://github.com/freeipa/freeipa/pull/4820. Additionally, other packages\nwhich use dogtag-pki must be investigated and updated if needed."}],"codename":null,"priority":"medium","cvss3":6.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://bugzilla.redhat.com/show_bug.cgi?id=1855273","https://github.com/dogtagpki/pki/commit/50c23ec146ee9abf28c9de87a5f7787d495f0b72","https://github.com/dogtagpki/pki/compare/v10.9.0-a2...v10.9.0-b1","https://www.cve.org/CVERecord?id=CVE-2020-15720"],"bugs":[""],"patches":{"dogtag-pki":["upstream: https://github.com/dogtagpki/pki/pull/443/"]},"tags":{},"packages":[{"name":"dogtag-pki","source":"https://ubuntu.com/security/cve?package=dogtag-pki","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=dogtag-pki","debian":"https://tracker.debian.org/pkg/dogtag-pki","statuses":[{"release_codename":"hirsute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"10.9.0-b1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was needed","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-15719","published":"2020-07-14T14:15:00","updated_at":"2025-08-25T23:21:35.931627+00:00","description":"\nlibldap in certain third-party OpenLDAP packages has a\ncertificate-validation flaw when the third-party package is asserting\nRFC6125 support. It considers CN even when there is a non-matching\nsubjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8\nin Red Hat Enterprise Linux.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"See RH bug for possible regression fixes\nper upstream bug, this is an issue with a RH patch to openldap\nand doesn't apply to upstream openldap.\nMarking as not-affected since Ubuntu does not carry the patch."}],"codename":null,"priority":"low","cvss3":4.2,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://access.redhat.com/errata/RHBA-2019:3674","https://www.cve.org/CVERecord?id=CVE-2020-15719"],"bugs":["https://bugs.openldap.org/show_bug.cgi?id=9266","https://bugzilla.redhat.com/show_bug.cgi?id=1740070","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965184"],"patches":{"openldap":[]},"tags":{},"packages":[{"name":"openldap","source":"https://ubuntu.com/security/cve?package=openldap","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap","debian":"https://tracker.debian.org/pkg/openldap","statuses":[{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-14621","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:50.305513+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: JAXP). Supported versions that are affected are Java SE: 7u261,\n8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable\nvulnerability allows unauthenticated attacker with network access via\nmultiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks of this vulnerability can result in unauthorized update, insert or\ndelete access to some of Java SE, Java SE Embedded accessible data. Note:\nThis vulnerability can only be exploited by supplying data to APIs in the\nspecified Component without using Untrusted Java Web Start applications or\nUntrusted Java applets, such as through a web service. CVSS 3.1 Base Score\n5.3 (Integrity impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14621"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"groovy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1","USN-4453-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]},{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14593","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:50.305513+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: 2D). Supported versions that are affected are Java SE: 7u261,\n8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable\nvulnerability allows unauthenticated attacker with network access via\nmultiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks require human interaction from a person other than the attacker and\nwhile the vulnerability is in Java SE, Java SE Embedded, attacks may\nsignificantly impact additional products. Successful attacks of this\nvulnerability can result in unauthorized creation, deletion or modification\naccess to critical data or all Java SE, Java SE Embedded accessible data.\nNote: This vulnerability applies to Java deployments, typically in clients\nrunning sandboxed Java Web Start applications or sandboxed Java applets,\nthat load and run untrusted code (e.g., code that comes from the internet)\nand rely on the Java sandbox for security. This vulnerability does not\napply to Java deployments, typically in servers, that load and run only\ntrusted code (e.g., code installed by an administrator). CVSS 3.1 Base\nScore 7.4 (Integrity impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14593"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1","USN-4453-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]},{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14583","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:50.305513+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: Libraries). Supported versions that are affected are Java SE:\n7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to\nexploit vulnerability allows unauthenticated attacker with network access\nvia multiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks require human interaction from a person other than the attacker and\nwhile the vulnerability is in Java SE, Java SE Embedded, attacks may\nsignificantly impact additional products. Successful attacks of this\nvulnerability can result in takeover of Java SE, Java SE Embedded. Note:\nThis vulnerability applies to Java deployments, typically in clients\nrunning sandboxed Java Web Start applications or sandboxed Java applets,\nthat load and run untrusted code (e.g., code that comes from the internet)\nand rely on the Java sandbox for security. This vulnerability does not\napply to Java deployments, typically in servers, that load and run only\ntrusted code (e.g., code installed by an administrator). CVSS 3.1 Base\nScore 8.3 (Confidentiality, Integrity and Availability impacts). CVSS\nVector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14583"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"groovy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1","USN-4453-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]},{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14581","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:50.305513+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: 2D). Supported versions that are affected are Java SE: 8u251,\n11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit\nvulnerability allows unauthenticated attacker with network access via\nmultiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks of this vulnerability can result in unauthorized read access to a\nsubset of Java SE, Java SE Embedded accessible data. Note: Applies to\nclient and server deployment of Java. This vulnerability can be exploited\nthrough sandboxed Java Web Start applications and sandboxed Java applets.\nIt can also be exploited by supplying data to APIs in the specified\nComponent without using sandboxed Java Web Start applications or sandboxed\nJava applets, such as through a web service. CVSS 3.1 Base Score 3.7\n(Confidentiality impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14581"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1","USN-4453-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]},{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14579","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:50.305513+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: Libraries). Supported versions that are affected are Java SE:\n7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit\nvulnerability allows unauthenticated attacker with network access via\nmultiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks of this vulnerability can result in unauthorized ability to cause a\npartial denial of service (partial DOS) of Java SE, Java SE Embedded. Note:\nApplies to client and server deployment of Java. This vulnerability can be\nexploited through sandboxed Java Web Start applications and sandboxed Java\napplets. It can also be exploited by supplying data to APIs in the\nspecified Component without using sandboxed Java Web Start applications or\nsandboxed Java applets, such as through a web service. CVSS 3.1 Base Score\n3.7 (Availability impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14579"],"bugs":[""],"patches":{"openjdk-8":[]},"tags":{},"packages":[{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"}]}],"notices_ids":["USN-4453-1"],"notices":[{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14578","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:50.305513+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: Libraries). Supported versions that are affected are Java SE:\n7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit\nvulnerability allows unauthenticated attacker with network access via\nmultiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks of this vulnerability can result in unauthorized ability to cause a\npartial denial of service (partial DOS) of Java SE, Java SE Embedded. Note:\nApplies to client and server deployment of Java. This vulnerability can be\nexploited through sandboxed Java Web Start applications and sandboxed Java\napplets. It can also be exploited by supplying data to APIs in the\nspecified Component without using sandboxed Java Web Start applications or\nsandboxed Java applets, such as through a web service. CVSS 3.1 Base Score\n3.7 (Availability impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14578"],"bugs":[""],"patches":{"openjdk-8":[]},"tags":{},"packages":[{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"}]}],"notices_ids":["USN-4453-1"],"notices":[{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14577","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:45.753176+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: JSSE). Supported versions that are affected are Java SE: 7u261,\n8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit\nvulnerability allows unauthenticated attacker with network access via TLS\nto compromise Java SE, Java SE Embedded. Successful attacks of this\nvulnerability can result in unauthorized read access to a subset of Java\nSE, Java SE Embedded accessible data. Note: Applies to client and server\ndeployment of Java. This vulnerability can be exploited through sandboxed\nJava Web Start applications and sandboxed Java applets. It can also be\nexploited by supplying data to APIs in the specified Component without\nusing sandboxed Java Web Start applications or sandboxed Java applets, such\nas through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality\nimpacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14577"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1","USN-4453-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]},{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14573","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:45.753176+00:00","description":"\nVulnerability in the Java SE product of Oracle Java SE (component:\nHotspot). Supported versions that are affected are Java SE: 11.0.7 and\n14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker\nwith network access via multiple protocols to compromise Java SE.\nSuccessful attacks of this vulnerability can result in unauthorized update,\ninsert or delete access to some of Java SE accessible data. Note: Applies\nto client and server deployment of Java. This vulnerability can be\nexploited through sandboxed Java Web Start applications and sandboxed Java\napplets. It can also be exploited by supplying data to APIs in the\nspecified Component without using sandboxed Java Web Start applications or\nsandboxed Java applets, such as through a web service. CVSS 3.1 Base Score\n3.7 (Integrity impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://www.cve.org/CVERecord?id=CVE-2020-14573"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14562","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:45.753176+00:00","description":"\nVulnerability in the Java SE product of Oracle Java SE (component:\nImageIO). Supported versions that are affected are Java SE: 11.0.7 and\n14.0.1. Easily exploitable vulnerability allows unauthenticated attacker\nwith network access via multiple protocols to compromise Java SE.\nSuccessful attacks of this vulnerability can result in unauthorized ability\nto cause a partial denial of service (partial DOS) of Java SE. Note: This\nvulnerability applies to Java deployments, typically in clients running\nsandboxed Java Web Start applications or sandboxed Java applets, that load\nand run untrusted code (e.g., code that comes from the internet) and rely\non the Java sandbox for security. This vulnerability does not apply to Java\ndeployments, typically in servers, that load and run only trusted code\n(e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3\n(Availability impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://www.cve.org/CVERecord?id=CVE-2020-14562"],"bugs":[""],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"bionic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14556","published":"2020-07-14T00:00:00","updated_at":"2025-08-25T23:20:45.753176+00:00","description":"\nVulnerability in the Java SE, Java SE Embedded product of Oracle Java SE\n(component: Libraries). Supported versions that are affected are Java SE:\n8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit\nvulnerability allows unauthenticated attacker with network access via\nmultiple protocols to compromise Java SE, Java SE Embedded. Successful\nattacks of this vulnerability can result in unauthorized update, insert or\ndelete access to some of Java SE, Java SE Embedded accessible data as well\nas unauthorized read access to a subset of Java SE, Java SE Embedded\naccessible data. Note: Applies to client and server deployment of Java.\nThis vulnerability can be exploited through sandboxed Java Web Start\napplications and sandboxed Java applets. It can also be exploited by\nsupplying data to APIs in the specified Component without using sandboxed\nJava Web Start applications or sandboxed Java applets, such as through a\nweb service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity\nimpacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","ubuntu_description":"","notes":[{"author":"sbeattie","note":"fix for openjdk-8 introduced a regression"}],"codename":null,"priority":"medium","cvss3":4.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-4433-1","https://ubuntu.com/security/notices/USN-4453-1","https://www.cve.org/CVERecord?id=CVE-2020-14556"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14556","https://bugs.openjdk.java.net/browse/JDK-8249677"],"patches":{"openjdk-8":[],"openjdk-lts":[],"openjdk-13":[]},"tags":{},"packages":[{"name":"openjdk-13","source":"https://ubuntu.com/security/cve?package=openjdk-13","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-13","debian":"https://tracker.debian.org/pkg/openjdk-13","statuses":[{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"groovy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lunar","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"ignored","description":"end of standard support, was ignored [superseded by openjdk-17]","component":null,"pocket":"security"}]},{"name":"openjdk-8","source":"https://ubuntu.com/security/cve?package=openjdk-8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-8","debian":"https://tracker.debian.org/pkg/openjdk-8","statuses":[{"release_codename":"focal","status":"released","description":"8u265-b01-0ubuntu2~20.04","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"8u265-b01-0ubuntu2~16.04","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"8u265-b01-0ubuntu2~18.04","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"8u262-b10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"openjdk-lts","source":"https://ubuntu.com/security/cve?package=openjdk-lts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openjdk-lts","debian":"https://tracker.debian.org/pkg/openjdk-lts","statuses":[{"release_codename":"focal","status":"released","description":"11.0.8+10-0ubuntu1~20.04","component":null,"pocket":"security"},{"release_codename":"groovy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"11.0.8+10-0ubuntu1~18.04.1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"impish","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"released","description":"11.0.8+10-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-4433-1","USN-4453-1"],"notices":[{"id":"USN-4433-1","title":"OpenJDK vulnerabilities","summary":"Several security issues were fixed in OpenJDK.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-07-23T18:07:48.362336","description":"Johannes Kuhn discovered that OpenJDK incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nIt was discovered that OpenJDK incorrectly handled memory allocation when\nreading TIFF image files. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-14562)\n\nIt was discovered that OpenJDK incorrectly handled input data. An\nattacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14573)\n\nPhilippe Arteau discovered that OpenJDK incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass the sandbox restrictions and cause unspecified impact.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~18.04.1","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~18.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~18.04.1","pocket":"security"}],"focal":[{"name":"openjdk-lts","version":"11.0.8+10-0ubuntu1~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-11-demo","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-doc","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jdk-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-headless","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-jre-zero","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"},{"name":"openjdk-11-source","version":"11.0.8+10-0ubuntu1~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-lts","version_link":"https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.8+10-0ubuntu1~20.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14562","CVE-2020-14573","CVE-2020-14577","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]},{"id":"USN-4453-1","title":"OpenJDK 8 vulnerabilities","summary":"Several security issues were fixed in OpenJDK 8.\n","instructions":"This update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any Java\napplications or applets to make all the necessary changes.\n","references":[],"published":"2020-08-05T17:58:05.423819","description":"Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control\ncontexts. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2020-14556)\n\nPhilippe Arteau discovered that OpenJDK 8 incorrectly verified names in\nTLS server's X.509 certificates. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2020-14577)\n\nIt was discovered that OpenJDK 8 incorrectly handled exceptions in\nDerInputStream class and in the DerValue.equals() method. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2020-14578, CVE-2020-14579)\n\nIt was discovered that OpenJDK 8 incorrectly handled image files. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-14581)\n\nMarkus Loewe discovered that OpenJDK 8 incorrectly handled concurrent\naccess in java.nio.Buffer class. An attacker could use this issue to\nbypass sandbox restrictions.\n(CVE-2020-14583)\n\nIt was discovered that OpenJDK 8 incorrectly handled transformation of\nimages. An attacker could possibly use this issue to bypass sandbox\nrestrictions and insert, edit or obtain sensitive information.\n(CVE-2020-14593)\n\nRoman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.\nAn attacker could possibly use this issue to insert, edit or obtain\nsensitive information. (CVE-2020-14621)\n","is_hidden":false,"release_packages":{"bionic":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~18.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~18.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~18.04","pocket":"security"}],"focal":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~20.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~20.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~20.04","pocket":"security"}],"xenial":[{"name":"openjdk-8","version":"8u265-b01-0ubuntu2~16.04","description":"Open Source Java implementation","is_source":true},{"name":"openjdk-8-demo","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-doc","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jdk-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-headless","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-jamvm","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-jre-zero","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"},{"name":"openjdk-8-source","version":"8u265-b01-0ubuntu2~16.04","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/openjdk-8","version_link":"https://launchpad.net/ubuntu/+source/openjdk-8/8u265-b01-0ubuntu2~16.04","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2020-14556","CVE-2020-14577","CVE-2020-14578","CVE-2020-14579","CVE-2020-14581","CVE-2020-14583","CVE-2020-14593","CVE-2020-14621"]}]},{"id":"CVE-2020-14300","published":"2020-07-13T22:15:00","updated_at":"2025-08-25T23:20:25.447625+00:00","description":"\nThe docker packages version docker-1.13.1-108.git4ef4b30.el7 as released\nfor Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053\n(https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect\nversion of runc that was missing multiple bug and security fixes. One of\nthe fixes regressed in that update was the fix for CVE-2016-9962, that was\npreviously corrected in the docker packages in Red Hat Enterprise Linux 7\nExtras via RHSA-2017:0116\n(https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was\nassigned to this security regression and it is specific to the docker\npackages produced by Red Hat. The original issue - CVE-2016-9962 - could\npossibly allow a process inside container to compromise a process entering\ncontainer namespace and execute arbitrary code outside of the container.\nThis could lead to compromise of the container host or other containers\nrunning on the same container host. This issue only affects a single\nversion of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise\nLinux 7. Both earlier and later versions are not affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2020-14300"],"bugs":[""],"patches":{"docker.io":[]},"tags":{},"packages":[{"name":"docker.io","source":"https://ubuntu.com/security/cve?package=docker.io","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=docker.io","debian":"https://tracker.debian.org/pkg/docker.io","statuses":[{"release_codename":"bionic","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"debian: Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2020-14298","published":"2020-07-13T21:15:00","updated_at":"2025-08-25T23:20:25.447625+00:00","description":"\nThe version of docker as released for Red Hat Enterprise Linux 7 Extras via\nRHBA-2020:0053 advisory included an incorrect version of runc missing the\nfix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This\nissue could allow a malicious or compromised container to compromise the\ncontainer host and other containers running on the same host. This issue\nonly affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat\nEnterprise Linux 7 Extras. Both earlier and later versions are not\naffected.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2020-14298"],"bugs":[""],"patches":{"docker.io":[]},"tags":{},"packages":[{"name":"docker.io","source":"https://ubuntu.com/security/cve?package=docker.io","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=docker.io","debian":"https://tracker.debian.org/pkg/docker.io","statuses":[{"release_codename":"bionic","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"debian: Red Hat specific regression","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"Red Hat specific regression","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2019-19338","published":"2020-07-13T17:15:00","updated_at":"2026-07-04T07:47:49.253203+00:00","description":"\nA flaw was found in the fix for CVE-2019-11135, in the Linux upstream\nkernel versions before 5.5 where, the way Intel CPUs handle speculative\nexecution of instructions when a TSX Asynchronous Abort (TAA) error occurs.\nWhen a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0),\nbut is not affected by the MDS issue (MDS_NO=1), the guest was to clear the\naffected buffers by using a VERW instruction mechanism. But when the\nMDS_NO=1 bit was exported to the guests, the guests did not use the VERW\nmechanism to clear the affected buffers. This issue affects guests running\non Cascade Lake CPUs and requires that host has 'TSX' enabled.\nConfidentiality of data is the highest threat associated with this\nvulnerability.","ubuntu_description":"","notes":[{"author":"tyhicks","note":"This is a vendor specific CVE for kernels that did not include upstream commit e1d38b63acd8 (\"kvm/x86: Export MDS_NO=0 to guests when TSX is enabled\") and defaulted to leaving TSX enabled. Ubuntu kernels included that commit and disabled TSX where possible as part of the initial TAA mitigations (CVE-2019-11135)."}],"codename":null,"priority":"medium","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.openwall.com/lists/oss-security/2019/12/10/3","https://www.cve.org/CVERecord?id=CVE-2019-19338"],"bugs":[""],"patches":{"linux":["break-fix: 1b42f017415b46c317e71d41c34ec088417a1883 e1d38b63acd843cfdd4222bf19a26700fd5c699e"],"linux-hwe":[],"linux-hwe-edge":[],"linux-lts-xenial":[],"linux-lts-trusty":[],"linux-oem":[],"linux-oem-osp1":[],"linux-kvm":[],"linux-aws":[],"linux-aws-5.0":[],"linux-aws-hwe":[],"linux-azure":[],"linux-azure-5.3":[],"linux-azure-edge":[],"linux-gcp":[],"linux-gcp-5.3":[],"linux-gcp-edge":[],"linux-gke-4.15":[],"linux-gke-5.0":[],"linux-oracle":[],"linux-oracle-5.0":[],"linux-raspi2":[],"linux-snapdragon":[]},"tags":{"linux":["binary-exclude:linux-libc-dev"]},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"}]},{"name":"linux-aws","source":"https://ubuntu.com/security/cve?package=linux-aws","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-aws","debian":"https://tracker.debian.org/pkg/linux-aws","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"}]},{"name":"linux-aws-5.0","source":"https://ubuntu.com/security/cve?package=linux-aws-5.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-aws-5.0","debian":"https://tracker.debian.org/pkg/linux-aws-5.0","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-aws-hwe","source":"https://ubuntu.com/security/cve?package=linux-aws-hwe","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-aws-hwe","debian":"https://tracker.debian.org/pkg/linux-aws-hwe","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-azure","source":"https://ubuntu.com/security/cve?package=linux-azure","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-azure","debian":"https://tracker.debian.org/pkg/linux-azure","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"}]},{"name":"linux-azure-5.3","source":"https://ubuntu.com/security/cve?package=linux-azure-5.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-azure-5.3","debian":"https://tracker.debian.org/pkg/linux-azure-5.3","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-azure-edge","source":"https://ubuntu.com/security/cve?package=linux-azure-edge","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-azure-edge","debian":"https://tracker.debian.org/pkg/linux-azure-edge","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support, was not-affected","component":null,"pocket":"security"}]},{"name":"linux-gcp","source":"https://ubuntu.com/security/cve?package=linux-gcp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-gcp","debian":"https://tracker.debian.org/pkg/linux-gcp","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-gcp-5.3","source":"https://ubuntu.com/security/cve?package=linux-gcp-5.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-gcp-5.3","debian":"https://tracker.debian.org/pkg/linux-gcp-5.3","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-gcp-edge","source":"https://ubuntu.com/security/cve?package=linux-gcp-edge","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-gcp-edge","debian":"https://tracker.debian.org/pkg/linux-gcp-edge","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-gke-4.15","source":"https://ubuntu.com/security/cve?package=linux-gke-4.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-gke-4.15","debian":"https://tracker.debian.org/pkg/linux-gke-4.15","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-gke-5.0","source":"https://ubuntu.com/security/cve?package=linux-gke-5.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-gke-5.0","debian":"https://tracker.debian.org/pkg/linux-gke-5.0","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-hwe","source":"https://ubuntu.com/security/cve?package=linux-hwe","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-hwe","debian":"https://tracker.debian.org/pkg/linux-hwe","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-hwe-edge","source":"https://ubuntu.com/security/cve?package=linux-hwe-edge","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-hwe-edge","debian":"https://tracker.debian.org/pkg/linux-hwe-edge","statuses":[{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"bionic","status":"ignored","description":"end of standard support, was not-affected","component":null,"pocket":"security"}]},{"name":"linux-kvm","source":"https://ubuntu.com/security/cve?package=linux-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-kvm","debian":"https://tracker.debian.org/pkg/linux-kvm","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-lts-trusty","source":"https://ubuntu.com/security/cve?package=linux-lts-trusty","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-trusty","debian":"https://tracker.debian.org/pkg/linux-lts-trusty","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-lts-xenial","source":"https://ubuntu.com/security/cve?package=linux-lts-xenial","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-lts-xenial","debian":"https://tracker.debian.org/pkg/linux-lts-xenial","statuses":[{"release_codename":"bionic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"ignored","description":"end of standard support","component":null,"pocket":"security"}]},{"name":"linux-oem","source":"https://ubuntu.com/security/cve?package=linux-oem","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-oem","debian":"https://tracker.debian.org/pkg/linux-oem","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"ignored","description":"end of standard support, was not-affected","component":null,"pocket":"security"}]},{"name":"linux-oem-osp1","source":"https://ubuntu.com/security/cve?package=linux-oem-osp1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-oem-osp1","debian":"https://tracker.debian.org/pkg/linux-oem-osp1","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-oracle","source":"https://ubuntu.com/security/cve?package=linux-oracle","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-oracle","debian":"https://tracker.debian.org/pkg/linux-oracle","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-oracle-5.0","source":"https://ubuntu.com/security/cve?package=linux-oracle-5.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-oracle-5.0","debian":"https://tracker.debian.org/pkg/linux-oracle-5.0","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"linux-raspi2","source":"https://ubuntu.com/security/cve?package=linux-raspi2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-raspi2","debian":"https://tracker.debian.org/pkg/linux-raspi2","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]},{"name":"linux-snapdragon","source":"https://ubuntu.com/security/cve?package=linux-snapdragon","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-snapdragon","debian":"https://tracker.debian.org/pkg/linux-snapdragon","statuses":[{"release_codename":"bionic","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"vendor specific","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":45100,"limit":20,"total_results":79316}