CVE-2019-2698
published 2019-04-23CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to…
PriorityP266high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EXPLOIT
EPSS
12.01%
95.7th percentile
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openjdk-11 | < openjdk-11 11.0.3+7-1 (bullseye) | openjdk-11 11.0.3+7-1 (bullseye) |
| debian | openjdk-8 | < openjdk-11 11.0.3+7-1 (bullseye) | openjdk-11 11.0.3+7-1 (bullseye) |
| hp | xp7_command_view | < 8.6.5-00 | 8.6.5-00 |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | java | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Heap corruption triggered by a specially crafted TrueType font (TTF) file passed to the Java font layout engine; look for Java processes loading external TTF files from untrusted sources. ↗
- →The vulnerable code path is in libfontmanager.so (Linux) / fontmanager DLL (Windows) via GlyphIterator::setCurrGlyphID — monitor for SIGSEGV/access violations originating from libfontmanager. ↗
- →The crash call stack includes Java_sun_font_SunLayoutEngine_nativeLayout in libfontmanager.so; JVM crashes with SIGSEGV at this native method indicate exploitation attempts. ↗
- →Exploitation is triggered via sandboxed Java Web Start applications or Java applets loading untrusted TTF fonts; monitor for applet/JNLP execution loading external font resources. ↗
- →Windows exploitation produces an access violation in fontmanager!Java_sun_java2d_loops_DrawGlyphListLCD_DrawGlyphListLCD; alert on this module/function in crash telemetry. ↗
- →Missing validation of the position value in GlyphIterator::setCurrGlyphID leads to memory corruption; the bug is tracked internally as OpenJDK bug 8219022. ↗
- ·java-11-openjdk on Red Hat Enterprise Linux 7 and 8 is explicitly listed as Not Affected. ↗
- ·The exploit requires high attack complexity (AC:H) per CVSS; exploitation is not trivial and requires a specially crafted font file delivered to a sandboxed client. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1LOW
vendor_redhat8.1HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p55v-v6gp-5c6j: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)
ghsa_unreviewed·2022-05-24
CVE-2019-2698 [HIGH] GHSA-p55v-v6gp-5c6j: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0
OSV
openjdk-8, openjdk-lts vulnerabilities
osv·2019-05-13·CVSS 7.5
CVE-2019-2602 [HIGH] openjdk-8, openjdk-lts vulnerabilities
openjdk-8, openjdk-lts vulnerabilities
It was discovered that the BigDecimal implementation in OpenJDK performed
excessive computation when given certain values. An attacker could use this
to cause a denial of service (excessive CPU usage). (CVE-2019-2602)
Corwin de Boor and Robert Xiao discovered that the RMI registry
implementation in OpenJDK did not properly select the correct skeleton
class in some situations. An attacker could use this to possibly escape
Java sandbox restrictions. (CVE-2019-2684)
Mateusz Jurczyk discovered a vulnerability in the 2D component of
OpenJDK. An attacker could use this to possibly escape Java sandbox
restrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04
LTS. (CVE-2019-2697)
Mateusz Jurczyk discovered a vulnerability in the font layout engine
OSV
CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)
osv·2019-04-23·CVSS 8.1
CVE-2019-2698 [HIGH] CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D)
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0
Ubuntu
OpenJDK vulnerabilities
vendor_ubuntu·2019-05-13·CVSS 7.5
CVE-2019-2602 [HIGH] OpenJDK vulnerabilities
Title: OpenJDK vulnerabilities
Summary: Several security issues were fixed in OpenJDK.
It was discovered that the BigDecimal implementation in OpenJDK performed
excessive computation when given certain values. An attacker could use this
to cause a denial of service (excessive CPU usage). (CVE-2019-2602)
Corwin de Boor and Robert Xiao discovered that the RMI registry
implementation in OpenJDK did not properly select the correct skeleton
class in some situations. An attacker could use this to possibly escape
Java sandbox restrictions. (CVE-2019-2684)
Mateusz Jurczyk discovered a vulnerability in the 2D component of
OpenJDK. An attacker could use this to possibly escape Java sandbox
restrictions. This issue only affected OpenJDK 8 in Ubuntu 16.04
LTS. (CVE-2019-2697)
Mateusz Jurczyk disc
Red Hat
OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
vendor_redhat·2019-04-16·CVSS 8.1
CVE-2019-2698 [HIGH] CWE-787 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that loa
Debian
CVE-2019-2698: openjdk-11 - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Sup...
vendor_debian·2019·CVSS 8.1
CVE-2019-2698 [HIGH] CVE-2019-2698: openjdk-11 - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Sup...
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0
No detection rules found.
Tenable
Oracle Critical Patch Update For April Contains 297 Fixes
blogs_tenable·2019-04-17
Oracle Critical Patch Update For April Contains 297 Fixes
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
bugzilla·2019-04-16·CVSS 8.1
CVE-2019-2698 [HIGH] CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
A out of bounds access flaw was found in the font layout engine in the 2D component of OpenJDK. Missing validation of the position value in GlyphIterator::setCurrGlyphID could lead to memory corruption, triggered by a specially crafted font file. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle CPU April 2019:
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html#AppendixJAVA
Fixed in Oracle Java 8u211 and 7u221.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2019:0774 https://access.redhat.com/errata/RHSA-2019:0774
---
This
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:1146https://access.redhat.com/errata/RHSA-2019:1163https://access.redhat.com/errata/RHSA-2019:1164https://access.redhat.com/errata/RHSA-2019:1165https://access.redhat.com/errata/RHSA-2019:1166https://access.redhat.com/errata/RHSA-2019:1238https://access.redhat.com/errata/RHSA-2019:1325https://lists.debian.org/debian-lts-announce/2019/05/msg00011.htmlhttps://seclists.org/bugtraq/2019/May/75https://security.gentoo.org/glsa/201908-10https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_ushttps://usn.ubuntu.com/3975-1/https://www.debian.org/security/2019/dsa-4453http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:1146https://access.redhat.com/errata/RHSA-2019:1163https://access.redhat.com/errata/RHSA-2019:1164https://access.redhat.com/errata/RHSA-2019:1165https://access.redhat.com/errata/RHSA-2019:1166https://access.redhat.com/errata/RHSA-2019:1238https://access.redhat.com/errata/RHSA-2019:1325https://lists.debian.org/debian-lts-announce/2019/05/msg00011.htmlhttps://seclists.org/bugtraq/2019/May/75https://security.gentoo.org/glsa/201908-10https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_ushttps://usn.ubuntu.com/3975-1/https://www.debian.org/security/2019/dsa-4453
2019-04-23
Published