SB2024041766 - Multiple vulnerabilities in Oracle GraalVM for JDK

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2024-21012)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

2) Improper input validation (CVE-ID: CVE-2024-21094)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

3) Improper input validation (CVE-ID: CVE-2024-21068)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

4) Improper input validation (CVE-ID: CVE-2024-21011)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

5) Improper input validation (CVE-ID: CVE-2024-21098)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Compiler component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

6) Improper input validation (CVE-ID: CVE-2024-20954)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Compiler component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

7) Improper handling of exceptional conditions (CVE-ID: CVE-2024-21892)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way certain environment variables are handled by Node.js on Linux. A local user can use a specially crafted environment variable to escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuapr2024.html?987627