Gentoo Project

Java

Security Bug Reports

• <dev-java/bcprov-1.65: Multiple vulnerabilities (CVE-2016-{1000338,1000339,1000340,1000341,1000342,1000343, 1000344,1000352}, CVE-2017-13098, CVE-2018-{1000180,1000613})

  717950 - Assigned to Gentoo Security
• <dev-java/c3p0-0.9.5.5: Denial of service ("billion laughs") by recursive XML expansion (CVE-2019-5427)

  719144 - Assigned to Gentoo Security
• <dev-java/bcprov-1.69: Invalid password comparison logic for bcrypt (CVE-2020-28052)

  760729 - Assigned to Gentoo Security
• <net-vpn/i2p-2.3.0: Eepsite deanonymization attack

  911550 - Assigned to Gentoo Security
• <dev-java/bcprov-1.74: LDAP injection vulnerability

  912248 - Assigned to Gentoo Security
• <dev-java/ant-ivy-2.5.3: multiple vulnerabilities

  916262 - Assigned to Gentoo Security
• <dev-java/gradle-bin-8.4: multiple vulnerabilities

  917402 - Assigned to Gentoo Security
• <dev-java/json-20231013: unconstrained memory usage DoS

  918529 - Assigned to Gentoo Security
• <dev-java/commons-compress-1.26.0-r1: multiple vulnerabilities

  924996 - Assigned to Gentoo Security
• <dev-java/fop-2.10: Improper Restriction of XML External Entity Reference

  941239 - Assigned to Gentoo Security
• <dev-java/json-smart-2.5.1: possible stack overflow

  947204 - Assigned to Gentoo Security
• <dev-java/commons-lang-3.19.0: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

  960838 - Assigned to Gentoo Security
• <www-servers/tomcat-{9.0.118,10.1.55,11.0.22}: Multiple vulnerabilities

  972560 - Assigned to Gentoo Security
• <dev-java/openjdk{,-bin,-jre-bin}-{8.492_p09,11.0.31_p11,17.0.19_p10,21.0.11_p10,25.0.3_p9}: multiple vulnerabilities

  974242 - Assigned to Gentoo Security
• <dev-java/assertj-core-3.27.7: has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

  976409 - Assigned to Gentoo Security
• <dev-java/log4j-core-2.25.4: multiple vulnerabilities

  977952 - Assigned to Gentoo Security
• dev-java/c3p0: Remote Code Execution via unsafe deserialization of userOverridesAsString property

  978760 - Assigned to Gentoo Security
• dev-java/log4j-api: Improper serialization of non-finite floating-point values in MapMessage.asJson()

  979129 - Assigned to Gentoo Security
• dev-java/ant-ivy: PackagerResolver path traversal vulnerability

  979320 - Assigned to Gentoo Security
• dev-java/openjdk, dev-java/openjdk-bin, dev-java/openjdk-jre-bin: multiple vulnerabilities

  979647 - Assigned to Gentoo Security
• dev-java/openjfx: openjfx:11 bundles and builds with a vulnerable precompiled old version of gradle

  979804 - Assigned to Gentoo Security
• dev-java/bcprov: and friends (bc{mail,pg,pkix,prov,util}), multiple vulnerabilities

  980052 - Assigned to Gentoo Security
• dev-java/openjdk-bin: multiple vulnerabilities

  981054 - Assigned to Gentoo Security
• www-servers/tomcat: multiple vulnerabilities

  981491 - Assigned to Gentoo Security
• dev-java/ant: Path traversal in ftp and scp tasks allows arbitrary file write

  982092 - Assigned to Gentoo Security