An update of the openjdk11 package has been released.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including:

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition     product of Oracle Java SE (component: Libraries). Supported versions that     are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle     GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2022-21476)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition     product of Oracle Java SE (component: Libraries). Supported versions that     are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise     Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to     compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful     attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2022-21449)

  -	Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition     product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle     GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via TLS     to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful     attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle     GraalVM Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2023-21930)

  -	An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.
    XSS, with resultant session stealing, can occur via JavaScript code in a     link (for a webmail redirection endpoint) within en email message, e.g., if     a victim clicks on that link within Zimbra webmail. (CVE-2023-48432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
203865	Photon OS 3.0: Openjdk11 PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/11/25	high
236622	Alibaba Cloud Linux 3 : 0026: java-11-openjdk (ALINUX3-SA-2022:0026)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
192099	Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 45, 9.x < 9.0.0 Patch 38, 10.0.x < 10.0.6 Multiple Vulnerabilities	Nessus	CGI abuses	2024/3/14	2024/11/25	high
164358	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2022-1631)	Nessus	Amazon Linux Local Security Checks	2022/8/23	2024/12/11	high

検出

プラグインの検索

high

medium

high

high