Advisories ยป MGASA-2023-0272

Updated java packages fix security vulnerabilities

Publication date: 30 Sep 2023
Modification date: 30 Sep 2023
Type: security
Affected Mageia releases : 8 , 9
CVE: CVE-2023-21930 , CVE-2023-21954 , CVE-2023-21967 , CVE-2023-21939 , CVE-2023-21938 , CVE-2023-21937 , CVE-2023-21968 , CVE-2023-22045 , CVE-2023-22049 , CVE-2023-25193 , CVE-2023-22006 , CVE-2023-22036 , CVE-2023-22044 , CVE-2023-22041

Description

The updated packages fix security vulnerabilities and a file conflict :

Improper connection handling during TLS handshake. (CVE-2023-21930)

Incorrect enqueue of references in garbage collector. (CVE-2023-21954)

Certificate validation issue in TLS session negotiation.
(CVE-2023-21967)

Swing HTML parsing issue. (CVE-2023-21939)

Incorrect handling of NULL characters in ProcessBuilder.
(CVE-2023-21938)

Missing string checks for NULL characters. (CVE-2023-21937)

Missing check for slash characters in URI-to-path conversion.
(CVE-2023-21968)

Array indexing integer overflow issue. (CVE-2023-22045)

Improper handling of slash characters in URI-to-path conversion.
(CVE-2023-22049)

O(n^2) growth via consecutive marks. (CVE-2023-25193)

HTTP client insufficient file name validation. (CVE-2023-22006)

ZIP file parsing infinite loop. (CVE-2023-22036)

Modulo operator array indexing issue. (CVE-2023-22044)

Weakness in AES implementation. (CVE-2023-22041)

References

SRPMS

9/core

8/core