Markus Loewe

A difficult to exploit vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data. This vulnerability applies to Java deployments in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code and rely on the Java sandbox for security.

The issue is related to an unauthenticated attacker with network access via multiple protocols being able to compromise Oracle Java SE and Oracle GraalVM Enterprise Edition, resulting in a partial denial of service. This vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited by using APIs in the specified component, for example, through a web service that supplies data to the APIs.

The issue is related to insufficient input validation in the Libraries component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This allows an unauthenticated attacker with network access via multiple protocols to compromise the system, resulting in a partial denial of service. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited through APIs in the specified component.

The issue is related to an easily exploitable vulnerability in the Libraries component of Oracle Java SE and Oracle GraalVM Enterprise Edition, allowing an unauthenticated attacker with network access via multiple protocols to compromise the system. This can result in a partial denial of service. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited through APIs in the specified component.

The issue is related to an unspecified vulnerability in the Utility component of Java SE and Oracle GraalVM Enterprise Edition. This vulnerability can be exploited by an unauthenticated attacker with network access via multiple protocols, allowing them to compromise Java SE and Oracle GraalVM Enterprise Edition. Successful attacks can result in a partial denial of service. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited through APIs in the specified component.

The issue is related to errors in resource release in the MySQL Server product, specifically in the Server: DML component. It allows a high-privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of the MySQL Server.

The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data. This issue applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified component.

The issue is related to insufficient input validation in the Libraries component of Java SE and Java SE Embedded. It allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE and Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some of the accessible data. This issue applies to Java deployments in clients running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code and rely on the Java sandbox for security.

A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code and rely on the Java sandbox for security. Successful attacks can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.

The issue is related to insufficient input validation in the Libraries component of Java SE and Java SE Embedded, allowing an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data. This can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component.

The issue is related to insufficient input validation in the Libraries component of Oracle Java SE and Java SE Embedded. This can be exploited by an unauthenticated attacker with network access via multiple protocols to compromise Java SE and Java SE Embedded, potentially leading to a takeover. The vulnerability affects Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security. It does not apply to Java deployments that load and run only trusted code, typically in servers.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.17.10 Description: The issue is related to an invalid pointer dereference in the `io ctl map page()` function when mounting and operating a crafted btrfs image. This is due to a lack of block group item validation in `check leaf item` in `fs/btrfs/tree-checker.c`. Exploitation of this issue may allow an attacker to cause a denial of service. Recommendations: For Linux kernel versions prior to 4.17.10, update to a version 4.17.10 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted btrfs images to minimize the risk of exploitation.