<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for java-1_8_0-ibm</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:3152-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-09-07T12:19:55Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-09-07T12:19:55Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-09-07T12:19:55Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for java-1_8_0-ibm</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for java-1_8_0-ibm fixes the following issues:

Note: the issues listed below were NOT fixed with the previous update (8.0-7.11).

- Update to Java 8.0 Service Refresh 7 Fix Pack 15 (bsc#1202427):
  - CVE-2022-34169: Fixed an integer truncation issue in the Xalan
    Java XSLT library that occurred when processing malicious
    stylesheets (bsc#1201684).
  - CVE-2022-21549: Fixed an issue that could lead to computing
    negative random exponentials (bsc#1201685).
  - CVE-2022-21541: Fixed a potential bypass of sandbox restrictions
    in the Hotspot component (bsc#1201692).
  - CVE-2022-21540: Fixed a potential bypass of sandbox restrictions
    in the Hotspot component (bsc#1201694)..
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-3152,SUSE-OpenStack-Cloud-9-2022-3152,SUSE-OpenStack-Cloud-Crowbar-9-2022-3152,SUSE-SLE-SAP-12-SP4-2022-3152,SUSE-SLE-SDK-12-SP5-2022-3152,SUSE-SLE-SERVER-12-SP2-BCL-2022-3152,SUSE-SLE-SERVER-12-SP3-BCL-2022-3152,SUSE-SLE-SERVER-12-SP4-LTSS-2022-3152,SUSE-SLE-SERVER-12-SP5-2022-3152</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20223152-1/</URL>
      <Description>Link for SUSE-SU-2022:3152-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-September/012164.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:3152-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201684</URL>
      <Description>SUSE Bug 1201684</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201685</URL>
      <Description>SUSE Bug 1201685</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201692</URL>
      <Description>SUSE Bug 1201692</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1201694</URL>
      <Description>SUSE Bug 1201694</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1202427</URL>
      <Description>SUSE Bug 1202427</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-21540/</URL>
      <Description>SUSE CVE CVE-2022-21540 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-21541/</URL>
      <Description>SUSE CVE CVE-2022-21541 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-21549/</URL>
      <Description>SUSE CVE CVE-2022-21549 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-34169/</URL>
      <Description>SUSE CVE CVE-2022-34169 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP2-BCL">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP2-BCL">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL" CPE="cpe:/o:suse:sles-bcl:12:sp2">SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP3-BCL">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP3-BCL">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-BCL" CPE="cpe:/o:suse:sles-bcl:12:sp3">SUSE Linux Enterprise Server 12 SP3-BCL</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP4-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp4">SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5" CPE="cpe:/o:suse:sles:12:sp5">SUSE Linux Enterprise Server 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP4" CPE="cpe:/o:suse:sles_sap:12:sp4">SUSE Linux Enterprise Server for SAP Applications 12 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5" CPE="cpe:/o:suse:sles_sap:12:sp5">SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 9">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 9">
        <FullProductName ProductID="SUSE OpenStack Cloud 9" CPE="cpe:/o:suse:suse-openstack-cloud:9">SUSE OpenStack Cloud 9</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 9">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 9">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:9">SUSE OpenStack Cloud Crowbar 9</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-32bit-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-32bit-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-32bit-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-demo-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-demo-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-demo-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-devel-32bit-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-devel-32bit-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-32bit-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-ibm-src-1.8.0_sr7.15-30.96.1">
      <FullProductName ProductID="java-1_8_0-ibm-src-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-src-1.8.0_sr7.15-30.96.1</FullProductName>
    </Branch>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP2-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1">java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1 as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).</Note>
    </Notes>
    <CVE>CVE-2022-21540</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20223152-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-21540.html</URL>
        <Description>CVE-2022-21540</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201694</URL>
        <Description>SUSE Bug 1201694</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1202427</URL>
        <Description>SUSE Bug 1202427</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).</Note>
    </Notes>
    <CVE>CVE-2022-21541</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20223152-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-21541.html</URL>
        <Description>CVE-2022-21541</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201692</URL>
        <Description>SUSE Bug 1201692</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1202427</URL>
        <Description>SUSE Bug 1202427</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).</Note>
    </Notes>
    <CVE>CVE-2022-21549</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20223152-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-21549.html</URL>
        <Description>CVE-2022-21549</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201685</URL>
        <Description>SUSE Bug 1201685</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1202427</URL>
        <Description>SUSE Bug 1202427</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.</Note>
    </Notes>
    <CVE>CVE-2022-34169</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP2-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-BCL:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP4-LTSS:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP4:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP5:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-alsa-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-devel-1.8.0_sr7.15-30.96.1</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:java-1_8_0-ibm-plugin-1.8.0_sr7.15-30.96.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20223152-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-34169.html</URL>
        <Description>CVE-2022-34169</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1201684</URL>
        <Description>SUSE Bug 1201684</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1202427</URL>
        <Description>SUSE Bug 1202427</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1207688</URL>
        <Description>SUSE Bug 1207688</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
