java-1.8.0-openjdk-1.8.0.262.b10-0.0.1.AXS4
エラータID: AXSA:2020-224:13
以下項目について対処しました。
[Security Fix]
- Java SE の Libraries コンポーネントには、ネットワークアクセスを通じて、
認証されていない攻撃者が JavaSE のデータの更新、挿入、削除が可能な
悪用困難な脆弱性があります。(CVE-2020-14556)
- Java SE の JSSE コンポーネントには、TLSによるネットワークアクセスを通じて、
認証されていない攻撃者が JavaSE のデータの読み込みが可能な悪用困難な脆弱性があります。
(CVE-2020-14577)
- Java SE の Libraries コンポーネントには、ネットワークアクセスを通じて、
認証されていない攻撃者が Java SE の部分的なサービス拒否を引き起こす
悪用困難な脆弱性があります。(CVE-2020-14578)
- Java SE の Libraries コンポーネントには、ネットワークアクセスを通じて、
認証されていない攻撃者が Java SE の部分的なサービス拒否を引き起こす
悪用困難な脆弱性があります。(CVE-2020-14579)
- Java SE の Libraries コンポーネントには、ネットワークアクセスを通じて、
認証されていない攻撃者なよる Java SE ののっ取りを許してしまう悪用困難な脆弱性が
あります。(CVE-2020-14583)
- Java SE の 2D コンポーネントには、ネットワークアクセスを通じて、
認証されていない攻撃者が Java SE のクリティカルなデータの作成、削除、
改変することを許してしまう悪用が容易な脆弱性があります。(CVE-2020-14593)
- Java SE の JAXP コンポーネントには、ネットワークアクセスを通じて、
認証されていない攻撃者が Java SE のデータの更新、挿入、削除をすることを
許してしまう脆弱性があります。(CVE-2020-14621)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
パッケージをアップデートしてください。
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
N/A
SRPMS
- java-1.8.0-openjdk-1.8.0.262.b10-0.0.1.AXS4.src.rpm
MD5: f018667858af4925e3622ab8e3fec5eb
SHA-256: ee2431aa6466305bf401ea6272c21b68c73d47881309fefadcdb9eefe11a5aaa
Size: 55.07 MB
Asianux Server 4 for x86
- java-1.8.0-openjdk-1.8.0.262.b10-0.0.1.AXS4.i686.rpm
MD5: 78edddba0bf49ec270b080e42d0e292b
SHA-256: 3dedf59c14b780f77d6e8b99fad61d5c909e01b3c9936bca0b8121703e63bccf
Size: 225.34 kB - java-1.8.0-openjdk-devel-1.8.0.262.b10-0.0.1.AXS4.i686.rpm
MD5: 1a1987bbfc1f7b77157c1a55cec9b5f3
SHA-256: 1a38f6ef19ba3252914d547b8369ac136873f18fd073e70990091657ea0d4785
Size: 10.11 MB - java-1.8.0-openjdk-headless-1.8.0.262.b10-0.0.1.AXS4.i686.rpm
MD5: f3ba91d1527302081847e4e6d5678078
SHA-256: c1f90137a6212ba2d3687dbea6fe9d2d342a1011671a35290ee6722f5e65b56f
Size: 31.79 MB
Asianux Server 4 for x86_64
- java-1.8.0-openjdk-1.8.0.262.b10-0.0.1.AXS4.x86_64.rpm
MD5: b91640a2a0be3129daf355723928bbe1
SHA-256: 87c4a2f33b256458c4ca2da5a9247988f878047ad5e8931604103d06497d355f
Size: 238.27 kB - java-1.8.0-openjdk-devel-1.8.0.262.b10-0.0.1.AXS4.x86_64.rpm
MD5: 657b50e004324c3e776300814b88f5de
SHA-256: 967ce294cf4dcc6bef330e19957691a51921969573aa7b717da40c3b551a18d6
Size: 10.11 MB - java-1.8.0-openjdk-headless-1.8.0.262.b10-0.0.1.AXS4.x86_64.rpm
MD5: 76141c7f85e005b3f51bc54b55c28555
SHA-256: dfa249e781fb5128b4f7d43c7442cde4ae4cea58a246233e229755fb46aead83
Size: 32.88 MB