USN-6810-1: OpenJDK 8 vulnerabilities

Releases

• Ubuntu 24.04 LTS
• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• openjdk-8 - Open Source Java implementation

Details

It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled certain exceptions with specially crafted long messages. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2024-21011)

Vladimir Kondratyev discovered that the Hotspot component of OpenJDK 8
incorrectly handled address offset calculations in the C1 compiler. An
attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. (CVE-2024-21068)

Yakov Shafranovich discovered that OpenJDK 8 did not properly manage
memory in the Pack200 archive format. An attacker could possibly use this
issue to cause a denial of service. (CVE-2024-21085)

It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C2 compiler. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2024-21094)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• openjdk-8-jdk - 8u412-ga-1~24.04.2
• openjdk-8-jdk-headless - 8u412-ga-1~24.04.2
• openjdk-8-jre - 8u412-ga-1~24.04.2
• openjdk-8-jre-headless - 8u412-ga-1~24.04.2
• openjdk-8-jre-zero - 8u412-ga-1~24.04.2

Ubuntu 23.10

• openjdk-8-jdk - 8u412-ga-1~23.10.1
• openjdk-8-jdk-headless - 8u412-ga-1~23.10.1
• openjdk-8-jre - 8u412-ga-1~23.10.1
• openjdk-8-jre-headless - 8u412-ga-1~23.10.1
• openjdk-8-jre-zero - 8u412-ga-1~23.10.1

Ubuntu 22.04

• openjdk-8-jdk - 8u412-ga-1~22.04.1
• openjdk-8-jdk-headless - 8u412-ga-1~22.04.1
• openjdk-8-jre - 8u412-ga-1~22.04.1
• openjdk-8-jre-headless - 8u412-ga-1~22.04.1
• openjdk-8-jre-zero - 8u412-ga-1~22.04.1

Ubuntu 20.04

• openjdk-8-jdk - 8u412-ga-1~20.04.1
• openjdk-8-jdk-headless - 8u412-ga-1~20.04.1
• openjdk-8-jre - 8u412-ga-1~20.04.1
• openjdk-8-jre-headless - 8u412-ga-1~20.04.1
• openjdk-8-jre-zero - 8u412-ga-1~20.04.1

Ubuntu 18.04

• openjdk-8-jdk - 8u412-ga-1~18.04.1
  Available with Ubuntu Pro
• openjdk-8-jdk-headless - 8u412-ga-1~18.04.1
  Available with Ubuntu Pro
• openjdk-8-jre - 8u412-ga-1~18.04.1
  Available with Ubuntu Pro
• openjdk-8-jre-headless - 8u412-ga-1~18.04.1
  Available with Ubuntu Pro
• openjdk-8-jre-zero - 8u412-ga-1~18.04.1
  Available with Ubuntu Pro

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.

References

• CVE-2024-21068
• CVE-2024-21085
• CVE-2024-21011
• CVE-2024-21094

Related notices

• USN-6811-1: openjdk-lts, openjdk-11-demo, openjdk-11-doc, openjdk-11-jre-zero, openjdk-11-source, openjdk-11-jre-headless, openjdk-11-jdk, openjdk-11-jdk-headless, openjdk-11-jre
• USN-6812-1: openjdk-17-doc, openjdk-17-demo, openjdk-17-jre-headless, openjdk-17, openjdk-17-jre, openjdk-17-jre-zero, openjdk-17-jdk-headless, openjdk-17-jdk, openjdk-17-source
• USN-6813-1: openjdk-21-jdk-headless, openjdk-21-jre, openjdk-21-jre-zero, openjdk-21-testsupport, openjdk-21, openjdk-21-doc, openjdk-21-jdk, openjdk-21-jre-headless, openjdk-21-source, openjdk-21-demo
• USN-7096-1: openjdk-8-jre, openjdk-8-jre-jamvm, openjdk-8-source, openjdk-8-jdk-headless, openjdk-8-demo, openjdk-8-jdk, openjdk-8, openjdk-8-doc, openjdk-8-jre-zero, openjdk-8-jre-headless