Test ID:	1.3.6.1.4.1.25623.1.0.843522
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3644-1)
Summary:	The remote host is missing an update for the 'openjdk-8' package(s) announced via the USN-3644-1 advisory.
Description:	Summary: The remote host is missing an update for the 'openjdk-8' package(s) announced via the USN-3644-1 advisory. Vulnerability Insight: It was discovered that the Security component of OpenJDK did not correctly perform merging of multiple sections for the same file listed in JAR archive file manifests. An attacker could possibly use this to modify attributes in a manifest without invalidating the signature. (CVE-2018-2790) Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo Focardi discovered that the Security component of OpenJDK did not restrict which classes could be used when deserializing keys from the JCEKS key stores. An attacker could use this to specially craft a JCEKS key store to execute arbitrary code. (CVE-2018-2794) It was discovered that the Security component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2795) It was discovered that the Concurrency component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2796) It was discovered that the JMX component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2797) It was discovered that the AWT component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2798) It was discovered that the JAXP component of OpenJDK in some situations did not properly limit the amount of memory allocated when performing deserialization. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2799) Moritz Bechler discovered that the RMI component of OpenJDK enabled HTTP transport for RMI servers by default. A remote attacker could use this to gain access to restricted services. (CVE-2018-2800) It was discovered that a vulnerability existed in the Hotspot component of OpenJDK affecting confidentiality, data integrity, and availability. An attacker could use this to specially craft an Java application that caused a denial of service or bypassed sandbox restrictions. (CVE-2018-2814) Apostolos Giannakidis discovered that the Serialization component of OpenJDK did not properly bound memory allocations in some situations. An attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-2815) David Benjamin discovered a vulnerability in the Security component of OpenJDK related to data integrity and confidentiality. A remote attacker could possibly use this to expose sensitive information. (CVE-2018-2783) Affected Software/OS: 'openjdk-8' package(s) on Ubuntu 16.04, Ubuntu 17.10. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-2783 BugTraq ID: 103832 http://www.securityfocus.com/bid/103832 RedHat Security Advisories: RHSA-2018:1203 https://access.redhat.com/errata/RHSA-2018:1203 RedHat Security Advisories: RHSA-2018:1205 https://access.redhat.com/errata/RHSA-2018:1205 RedHat Security Advisories: RHSA-2018:1721 https://access.redhat.com/errata/RHSA-2018:1721 RedHat Security Advisories: RHSA-2018:1722 https://access.redhat.com/errata/RHSA-2018:1722 RedHat Security Advisories: RHSA-2018:1723 https://access.redhat.com/errata/RHSA-2018:1723 RedHat Security Advisories: RHSA-2018:1724 https://access.redhat.com/errata/RHSA-2018:1724 RedHat Security Advisories: RHSA-2018:1974 https://access.redhat.com/errata/RHSA-2018:1974 RedHat Security Advisories: RHSA-2018:1975 https://access.redhat.com/errata/RHSA-2018:1975 http://www.securitytracker.com/id/1040697 https://usn.ubuntu.com/3644-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-2790 BugTraq ID: 103877 http://www.securityfocus.com/bid/103877 Debian Security Information: DSA-4185 (Google Search) https://www.debian.org/security/2018/dsa-4185 Debian Security Information: DSA-4225 (Google Search) https://www.debian.org/security/2018/dsa-4225 https://security.gentoo.org/glsa/201903-14 RedHat Security Advisories: RHSA-2018:1188 https://access.redhat.com/errata/RHSA-2018:1188 RedHat Security Advisories: RHSA-2018:1191 https://access.redhat.com/errata/RHSA-2018:1191 RedHat Security Advisories: RHSA-2018:1201 https://access.redhat.com/errata/RHSA-2018:1201 RedHat Security Advisories: RHSA-2018:1202 https://access.redhat.com/errata/RHSA-2018:1202 RedHat Security Advisories: RHSA-2018:1204 https://access.redhat.com/errata/RHSA-2018:1204 RedHat Security Advisories: RHSA-2018:1206 https://access.redhat.com/errata/RHSA-2018:1206 RedHat Security Advisories: RHSA-2018:1270 https://access.redhat.com/errata/RHSA-2018:1270 RedHat Security Advisories: RHSA-2018:1278 https://access.redhat.com/errata/RHSA-2018:1278 https://usn.ubuntu.com/3691-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-2794 BugTraq ID: 103817 http://www.securityfocus.com/bid/103817 Common Vulnerability Exposure (CVE) ID: CVE-2018-2795 BugTraq ID: 103847 http://www.securityfocus.com/bid/103847 Common Vulnerability Exposure (CVE) ID: CVE-2018-2796 BugTraq ID: 103868 http://www.securityfocus.com/bid/103868 Common Vulnerability Exposure (CVE) ID: CVE-2018-2797 BugTraq ID: 103846 http://www.securityfocus.com/bid/103846 Common Vulnerability Exposure (CVE) ID: CVE-2018-2798 BugTraq ID: 103841 http://www.securityfocus.com/bid/103841 Common Vulnerability Exposure (CVE) ID: CVE-2018-2799 BugTraq ID: 103872 http://www.securityfocus.com/bid/103872 https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73@%3Cj-users.xerces.apache.org%3E https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307@%3Cuser.spark.apache.org%3E https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d@%3Cfop-dev.xmlgraphics.apache.org%3E Common Vulnerability Exposure (CVE) ID: CVE-2018-2800 BugTraq ID: 103849 http://www.securityfocus.com/bid/103849 Common Vulnerability Exposure (CVE) ID: CVE-2018-2814 BugTraq ID: 103798 http://www.securityfocus.com/bid/103798 Common Vulnerability Exposure (CVE) ID: CVE-2018-2815 BugTraq ID: 103848 http://www.securityfocus.com/bid/103848
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.