<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for java-1_8_0-openjdk</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2019:2036-2</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2019-08-01T15:36:09Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2019-08-01T15:36:09Z</InitialReleaseDate>
    <CurrentReleaseDate>2019-08-01T15:36:09Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for java-1_8_0-openjdk</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for java-1_8_0-openjdk to version 8u222 fixes the following issues:

Security issues fixed:

- CVE-2019-2745: Improved ECC Implementation (bsc#1141784).
- CVE-2019-2762: Exceptional throw cases (bsc#1141782).
- CVE-2019-2766: Improve file protocol handling (bsc#1141789).
- CVE-2019-2769: Better copies of CopiesList (bsc#1141783).
- CVE-2019-2786: More limited privilege usage (bsc#1141787).
- CVE-2019-2816: Normalize normalization (bsc#1141785).
- CVE-2019-2842: Extended AES support (bsc#1141786).
- CVE-2019-7317: Improve PNG support (bsc#1141780).
- Certificate validation improvements

Non-security issue fixed:

- Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2019-2036,SUSE-Storage-5-2019-2036</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      <Description>Link for SUSE-SU-2019:2036-2</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2019-August/005820.html</URL>
      <Description>E-Mail link for SUSE-SU-2019:2036-2</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1115375</URL>
      <Description>SUSE Bug 1115375</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141780</URL>
      <Description>SUSE Bug 1141780</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141782</URL>
      <Description>SUSE Bug 1141782</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141783</URL>
      <Description>SUSE Bug 1141783</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141784</URL>
      <Description>SUSE Bug 1141784</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141785</URL>
      <Description>SUSE Bug 1141785</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141786</URL>
      <Description>SUSE Bug 1141786</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141787</URL>
      <Description>SUSE Bug 1141787</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1141789</URL>
      <Description>SUSE Bug 1141789</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2745/</URL>
      <Description>SUSE CVE CVE-2019-2745 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2762/</URL>
      <Description>SUSE CVE CVE-2019-2762 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2766/</URL>
      <Description>SUSE CVE CVE-2019-2766 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2769/</URL>
      <Description>SUSE CVE CVE-2019-2769 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2786/</URL>
      <Description>SUSE CVE CVE-2019-2786 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2816/</URL>
      <Description>SUSE CVE CVE-2019-2816 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-2842/</URL>
      <Description>SUSE CVE CVE-2019-2842 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-7317/</URL>
      <Description>SUSE CVE CVE-2019-7317 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Enterprise Storage 5">
      <Branch Type="Product Name" Name="SUSE Enterprise Storage 5">
        <FullProductName ProductID="SUSE Enterprise Storage 5" CPE="cpe:/o:suse:ses:5">SUSE Enterprise Storage 5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-1.8.0.222-27.35.2">java-1_8_0-openjdk-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-accessibility-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-accessibility-1.8.0.222-27.35.2">java-1_8_0-openjdk-accessibility-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-demo-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-demo-1.8.0.222-27.35.2">java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-devel-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-devel-1.8.0.222-27.35.2">java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-headless-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-headless-1.8.0.222-27.35.2">java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-javadoc-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-javadoc-1.8.0.222-27.35.2">java-1_8_0-openjdk-javadoc-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="java-1_8_0-openjdk-src-1.8.0.222-27.35.2">
      <FullProductName ProductID="java-1_8_0-openjdk-src-1.8.0.222-27.35.2">java-1_8_0-openjdk-src-1.8.0.222-27.35.2</FullProductName>
    </Branch>
    <Relationship ProductReference="java-1_8_0-openjdk-1.8.0.222-27.35.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 5">
      <FullProductName ProductID="SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2">java-1_8_0-openjdk-1.8.0.222-27.35.2 as a component of SUSE Enterprise Storage 5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-openjdk-demo-1.8.0.222-27.35.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 5">
      <FullProductName ProductID="SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2">java-1_8_0-openjdk-demo-1.8.0.222-27.35.2 as a component of SUSE Enterprise Storage 5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-openjdk-devel-1.8.0.222-27.35.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 5">
      <FullProductName ProductID="SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2">java-1_8_0-openjdk-devel-1.8.0.222-27.35.2 as a component of SUSE Enterprise Storage 5</FullProductName>
    </Relationship>
    <Relationship ProductReference="java-1_8_0-openjdk-headless-1.8.0.222-27.35.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 5">
      <FullProductName ProductID="SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2">java-1_8_0-openjdk-headless-1.8.0.222-27.35.2 as a component of SUSE Enterprise Storage 5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).</Note>
    </Notes>
    <CVE>CVE-2019-2745</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.9</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2745.html</URL>
        <Description>CVE-2019-2745</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141784</URL>
        <Description>SUSE Bug 1141784</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).</Note>
    </Notes>
    <CVE>CVE-2019-2762</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2762.html</URL>
        <Description>CVE-2019-2762</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141782</URL>
        <Description>SUSE Bug 1141782</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1147021</URL>
        <Description>SUSE Bug 1147021</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).</Note>
    </Notes>
    <CVE>CVE-2019-2766</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2766.html</URL>
        <Description>CVE-2019-2766</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141789</URL>
        <Description>SUSE Bug 1141789</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1147021</URL>
        <Description>SUSE Bug 1147021</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).</Note>
    </Notes>
    <CVE>CVE-2019-2769</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2769.html</URL>
        <Description>CVE-2019-2769</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141783</URL>
        <Description>SUSE Bug 1141783</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1147021</URL>
        <Description>SUSE Bug 1147021</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).</Note>
    </Notes>
    <CVE>CVE-2019-2786</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2786.html</URL>
        <Description>CVE-2019-2786</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141787</URL>
        <Description>SUSE Bug 1141787</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1147021</URL>
        <Description>SUSE Bug 1147021</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).</Note>
    </Notes>
    <CVE>CVE-2019-2816</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2816.html</URL>
        <Description>CVE-2019-2816</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141785</URL>
        <Description>SUSE Bug 1141785</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1147021</URL>
        <Description>SUSE Bug 1147021</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).</Note>
    </Notes>
    <CVE>CVE-2019-2842</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-2842.html</URL>
        <Description>CVE-2019-2842</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141786</URL>
        <Description>SUSE Bug 1141786</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="8">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.</Note>
    </Notes>
    <CVE>CVE-2019-7317</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-demo-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-devel-1.8.0.222-27.35.2</ProductID>
        <ProductID>SUSE Enterprise Storage 5:java-1_8_0-openjdk-headless-1.8.0.222-27.35.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20192036-2/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-7317.html</URL>
        <Description>CVE-2019-7317</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1124211</URL>
        <Description>SUSE Bug 1124211</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1135824</URL>
        <Description>SUSE Bug 1135824</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1141780</URL>
        <Description>SUSE Bug 1141780</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1147021</URL>
        <Description>SUSE Bug 1147021</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1165297</URL>
        <Description>SUSE Bug 1165297</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
