The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7096-1 advisory.

    Andy Boothe discovered that the Networking component of OpenJDK 8 did not properly handle access under     certain circumstances. An unauthenticated

    attacker could possibly use this issue to cause a denial of service.

    (CVE-2024-21208)

    It was discovered that the Hotspot component of OpenJDK 8 did not properly handle vectorization under     certain circumstances. An unauthenticated

    attacker could possibly use this issue to access unauthorized resources

    and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)

    It was discovered that the Serialization component of OpenJDK 8 did not

    properly handle deserialization under certain circumstances. An

    unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21217)

    It was discovered that the Hotspot component of OpenJDK 8 was not properly bounding certain UTF-8 strings,     which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of     service or execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21131)

    It was discovered that the Hotspot component of OpenJDK 8 could be made to run into an infinite loop. If     an automated system were tricked into processing excessively large symbols, an attacker could possibly use     this issue to cause a denial of service. This issue was only addressed in Ubuntu 16.04 LTS.
    (CVE-2024-21138)

    It was discovered that the Hotspot component of OpenJDK 8 did not properly perform range check     elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary     code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 16.04 LTS.

    (CVE-2024-21140)

    Yakov Shafranovich discovered that the Concurrency component of OpenJDK 8 incorrectly performed header     validation in the Pack200 archive format. An attacker could possibly use this issue to cause a denial of     service. This

    issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21144)

    Sergey Bylokhov discovered that OpenJDK 8 did not properly manage memory when handling 2D images. An     attacker could possibly use this issue to obtain sensitive information. This issue was only addressed in     Ubuntu

    16.04 LTS. (CVE-2024-21145)

    It was discovered that the Hotspot component of OpenJDK 8 incorrectly handled memory when performing range     check elimination under certain circumstances. An attacker could possibly use this issue to cause a denial     of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only addressed in     Ubuntu 16.04 LTS.

    (CVE-2024-21147)

    It was discovered that the Hotspot component of OpenJDK 8 incorrectly handled certain exceptions with     specially crafted long messages. An attacker could possibly use this issue to cause a denial of service.
    This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21011)

    Vladimir Kondratyev discovered that the Hotspot component of OpenJDK 8 incorrectly handled address offset     calculations in the C1 compiler. An attacker could possibly use this issue to cause a denial of service or     execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21068)

    Yakov Shafranovich discovered that OpenJDK 8 did not properly manage memory in the Pack200 archive format.
    An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in     Ubuntu 16.04 LTS. (CVE-2024-21085)

    It was discovered that the Hotspot component of OpenJDK 8 incorrectly handled array accesses in the C2     compiler. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21094)

    Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly handled array accesses in the C1     compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code     or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20918)

    It was discovered that the Hotspot component of OpenJDK 8 did not properly verify bytecode in certain     situations. An attacker could possibly use this issue to bypass Java sandbox restrictions. This

    issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20919)

    It was discovered that the Hotspot component of OpenJDK 8 had an optimization flaw when generating range     check loop predicates. An attacker could possibly use this issue to cause a denial of service, execute     arbitrary code or bypass Java sandbox restrictions. This issue was only

    addressed in Ubuntu 16.04 LTS. (CVE-2024-20921)

    Valentin Eudeline discovered that OpenJDK 8 incorrectly handled certain options in the Nashorn JavaScript     subcomponent. An attacker could possibly use this issue to execute arbitrary code. This issue was only

    addressed in Ubuntu 16.04 LTS. (CVE-2024-20926)

    It was discovered that OpenJDK 8 could produce debug logs that contained private keys used for digital     signatures. An attacker could possibly use this issue to obtain sensitive information. This issue was only     addressed in Ubuntu 16.04 LTS. (CVE-2024-20945)

    Hubert Kario discovered that the TLS implementation in OpenJDK 8 had a timing side-channel and incorrectly     handled RSA padding. A remote attacker could possibly use this issue to recover sensitive information.
    This

    issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20952)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenJDK 8 vulnerabilities (USN-7096-1)

high Nessus Plugin ID 210735

Version 1.1