保安警报 (A23-01-10): Oracle Java 及 Oracle 产品多个漏洞 (2023年1月)

描述:

Oracle 发布了重要修补程式更新公告，包括一系列应对 Java SE 和不同 Oracle 产品中多个保安漏洞的修补程式。有关安全性更新的列表，请参考以下网址：
https://www.oracle.com/security-alerts/cpujan2023.html

受影响的系统:

• Oracle Java SE
• Database
• Fusion Applications and Middleware
• Oracle MySQL Product Suite
• Oracle and Sun Systems Products Suite
• Oracle Linux and Virtualization

有关受影响产品的完整列表，请参阅以下网址：
https://www.oracle.com/security-alerts/cpujan2023.html

影响:

成功利用漏洞可在受影响的系统导致远端执行程式码、数据操纵、服务被拒绝、泄漏资讯或绕过保安限制，视乎攻击者利用哪个漏洞而定。

建议:

现已有适用於受影响系统的修补程式。受影响系统的用户应遵从产品供应商的建议，立即采取行动以降低风险。

Oracle Java SE 产品的修补程式可从以下连结下载：

• Java Platform SE 8u361 (JDK 及 JRE)
• Java Platform SE 11.0.18 (JDK 及 JRE)
• Java Platform SE 17.0.6 (JDK 及 JRE)
• Java Platform SE 19.0.2 (JDK 及 JRE)

https://www.oracle.com/java/technologies/javase-downloads.html

OpenJDK 的修补程式可从以下连结下载：
https://jdk.java.net/

用户也可通过以下安全公告，以获取其他 Oracle 产品安全更新方面的资讯。
https://www.oracle.com/security-alerts/cpujan2023.html

用户可联络其产品支援供应商，以取得修补程式及相关支援。

进一步信息:

• https://www.oracle.com/security-alerts/cpujan2023.html
• https://www.hkcert.org/tc/security-bulletin/oracle-products-multiple-vulnerabilities_20230118
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7317
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12415
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10683
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10693
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11979
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11987
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13956
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27844
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36242
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36518
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2351
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3918
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31805
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31812
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36483
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36770
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37533
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40528
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41184
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41411
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42717
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43797
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0084
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0492
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0934
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1122
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1304
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1319
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1941
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2048
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2053
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2274
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2509
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2526
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3028
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3510
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4147
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22970 (to CVE-2022-22971)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22978
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23219
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23221
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23437
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23457
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24329
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24823
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24839
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24903
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25236
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25315
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25647
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26336
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27404
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27782
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30126
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30293
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31129
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31629
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31692
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31813
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32221
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33980
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34169
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34305
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35737
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36055
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37454
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38752
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39271
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39429
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40146
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40149 (to CVE-2022-40150)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40153
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40664
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41720
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41881
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42252
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42920
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43403
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43548
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45047
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21824 (to CVE-2023-21832)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21834 (to CVE-2023-21894)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21898 (to CVE-2023-21900)