Sergey Bylokhov

**Name of the Vulnerable Software and Affected Versions** Oracle Java SE versions 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM for JDK versions 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM Enterprise Edition versions 20.3.14, 21.3.10 **Description** A difficult to exploit vulnerability in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access via multiple protocols to compromise these products. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. This vulnerability can be exploited by using APIs in the specified component, for example, through a web service that supplies data to the APIs. It also applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. **Recommendations** For Oracle Java SE versions 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1, update to a version that contains the fix for this vulnerability. For Oracle GraalVM for JDK versions 17.0.11, 21.0.3, 22.0.1, update to a version that contains the fix for this vulnerability. For Oracle GraalVM Enterprise Edition versions 20.3.14, 21.3.10, update to a version that contains the fix for this vulnerability. As a temporary workaround, consider restricting access to the 2D component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle Java SE version 17.0.9 Oracle GraalVM for JDK version 17.0.9 Oracle GraalVM Enterprise Edition versions 21.3.8 and 22.3.4 **Description** The issue is related to insufficient input validation in the Security component of the affected software, allowing an unauthenticated attacker with network access via multiple protocols to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data. This vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security. **Recommendations** For Oracle Java SE version 17.0.9, update to a newer version that contains a fix for this vulnerability. For Oracle GraalVM for JDK version 17.0.9, update to a newer version that contains a fix for this vulnerability. For Oracle GraalVM Enterprise Edition versions 21.3.8 and 22.3.4, update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the Security component in the affected software until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.4 **Description** The issue involves the "Menus" component and is caused by a buffer overflow, allowing attackers to obtain sensitive information or cause a denial of service, including out-of-bounds read and application crash, via a crafted app. **Recommendations** For macOS versions prior to 10.12.4, update to version 10.12.4 or later to resolve the issue.