USN-3275-1

It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. (CVE-2017-3509)

It was discovered that an untrusted library search path flaw existed in the Java Cryptography Extension (JCE) component of OpenJDK. A local attacker could possibly use this to gain the privileges of a Java application. (CVE-2017-3511)

It was discovered that the Java API for XML Processing (JAXP) component in OpenJDK did not properly enforce size limits when parsing XML documents. An attacker could use this to cause a denial of service (processor and memory consumption). (CVE-2017-3526)

It was discovered that the FTP client implementation in OpenJDK did not properly sanitize user inputs. If a user was tricked into opening a specially crafted FTP URL, a remote attacker could use this to manipulate the FTP connection. (CVE-2017-3533)

It was discovered that OpenJDK allowed MD5 to be used as an algorithm for JAR integrity verification. An attacker could possibly use this to modify the contents of a JAR file without detection. (CVE-2017-3539)

It was discovered that the SMTP client implementation in OpenJDK did not properly sanitize sender and recipient addresses. A remote attacker could use this to specially craft email addresses and gain control of a Java application's SMTP connections. (CVE-2017-3544)

References

Affected packages

Ubuntu:16.04:LTS / openjdk-8

Package

Name: openjdk-8
Purl: pkg:deb/ubuntu/openjdk-8@8u131-b11-0ubuntu1.16.04.2?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8u131-b11-0ubuntu1.16.04.2

Affected versions

Other

8u66-b01-5

8u72-b05-1ubuntu1

8u72-b05-5

8u72-b05-6

8u72-b15-1

8u72-b15-2ubuntu1

8u72-b15-2ubuntu3

8u72-b15-3ubuntu1

8u77-b03-1ubuntu2

8u77-b03-3ubuntu1

8u77-b03-3ubuntu2

8u77-b03-3ubuntu3

8u91-b14-0ubuntu4~16.*

8u91-b14-0ubuntu4~16.04.1

8u91-b14-3ubuntu1~16.*

8u91-b14-3ubuntu1~16.04.1

8u111-b14-2ubuntu0.*

8u111-b14-2ubuntu0.16.04.2

8u121-b13-0ubuntu1.*

8u121-b13-0ubuntu1.16.04.2

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "openjdk-8-demo",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-jdk",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-jdk-headless",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-jre",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-jre-headless",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-jre-jamvm",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-jre-zero",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        },
        {
            "binary_name": "openjdk-8-source",
            "binary_version": "8u131-b11-0ubuntu1.16.04.2"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2017-3509",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2017-3511",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2017-3526",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2017-3533",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        },
        {
            "id": "CVE-2017-3539",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        },
        {
            "id": "CVE-2017-3544",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:16.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3275-1.json"