openSUSE-SU-2022:0816-1

    Dashboard / Vulnerabilities / openSUSE-SU-2022:0816-1

    openSUSE-SU-2022:0816-1

    Published: 14 Mar 2022Last Modified: 4 Feb 2026

    Summary: Security update for java-11-openjdk

    Details: This update for java-11-openjdk fixes the following issues: - CVE-2022-21248: Fixed incomplete deserialization class filtering in ObjectInputStream. (bnc#1194926) - CVE-2022-21277: Fixed incorrect reading of TIFF files in TIFFNullDecompressor. (bnc#1194930) - CVE-2022-21282: Fixed Insufficient URI checks in the XSLT TransformerImpl. (bnc#1194933) - CVE-2022-21283: Fixed unexpected exception thrown in regex Pattern. (bnc#1194937) - CVE-2022-21291: Fixed Incorrect marking of writeable fields. (bnc#1194925) - CVE-2022-21293: Fixed Incomplete checks of StringBuffer and StringBuilder during deserialization. (bnc#1194935) - CVE-2022-21294: Fixed Incorrect IdentityHashMap size checks during deserialization. (bnc#1194934) - CVE-2022-21296: Fixed Incorrect access checks in XMLEntityManager. (bnc#1194932) - CVE-2022-21299: Fixed Infinite loop related to incorrect handling of newlines in XMLEntityScanner. (bnc#1194931) - CVE-2022-21305: Fixed Array indexing issues in LIRGenerator. (bnc#1194939) - CVE-2022-21340: Fixed Excessive resource use when reading JAR manifest attributes. (bnc#1194940) - CVE-2022-21341: Fixed OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream. (bnc#1194941) - CVE-2022-21360: Fixed Excessive memory allocation in BMPImageReader. (bnc#1194929) - CVE-2022-21365: Fixed Integer overflow in BMPImageReader. (bnc#1194928) - CVE-2022-21366: Fixed Excessive memory allocation in TIFF*Decompressor. (bnc#1194927)

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/U6OQKLWM3DMDDCKHLY4KFE6NXSK5MSXV/, https://bugzilla.suse.com/1194925, https://bugzilla.suse.com/1194926, https://bugzilla.suse.com/1194927, https://bugzilla.suse.com/1194928, https://bugzilla.suse.com/1194929, https://bugzilla.suse.com/1194930, https://bugzilla.suse.com/1194931, https://bugzilla.suse.com/1194932, https://bugzilla.suse.com/1194933, https://bugzilla.suse.com/1194934, https://bugzilla.suse.com/1194935, https://bugzilla.suse.com/1194937, https://bugzilla.suse.com/1194939, https://bugzilla.suse.com/1194940, https://bugzilla.suse.com/1194941, https://www.suse.com/security/cve/CVE-2022-21248, https://www.suse.com/security/cve/CVE-2022-21277, https://www.suse.com/security/cve/CVE-2022-21282, https://www.suse.com/security/cve/CVE-2022-21283, https://www.suse.com/security/cve/CVE-2022-21291, https://www.suse.com/security/cve/CVE-2022-21293, https://www.suse.com/security/cve/CVE-2022-21294, https://www.suse.com/security/cve/CVE-2022-21296, https://www.suse.com/security/cve/CVE-2022-21299, https://www.suse.com/security/cve/CVE-2022-21305, https://www.suse.com/security/cve/CVE-2022-21340, https://www.suse.com/security/cve/CVE-2022-21341, https://www.suse.com/security/cve/CVE-2022-21360, https://www.suse.com/security/cve/CVE-2022-21365, https://www.suse.com/security/cve/CVE-2022-21366

    Affected packages

    Package

    Name: java-11-openjdk

    Purl: pkg:rpm/opensuse/java-11-openjdk&distro=openSUSE%20Leap%2015.3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -11.0.14.0-3.74.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2022:0816-1 | CVE-DB