Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Red Hat Console
  • Get Support
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Red Hat Console
  • Get Support
  • Products

    Top Products

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform
    All Products

    Downloads and Containers

    • Downloads
    • Packages
    • Containers

    Top Resources

    • Documentation
    • Product Life Cycles
    • Product Compliance
    • Errata
  • Knowledge

    Red Hat Knowledge Center

    • Knowledgebase Solutions
    • Knowledgebase Articles
    • Customer Portal Labs
    • Errata

    Top Product Docs

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform
    All Product Docs

    Training and Certification

    • About
    • Course Index
    • Certification Index
    • Skill Assessment
  • Security

    Red Hat Product Security Center

    • Security Updates
    • Security Advisories
    • Red Hat CVE Database
    • Errata

    References

    • Security Bulletins
    • Security Measurement
    • Severity Ratings
    • Security Data

    Top Resources

    • Security Labs
    • Backporting Policies
    • Security Blog
  • Support

    Red Hat Support

    • Support Cases
    • Troubleshoot
    • Get Support
    • Contact Red Hat Support

    Red Hat Community Support

    • Customer Portal Community
    • Community Discussions
    • Red Hat Accelerator Program

    Top Resources

    • Product Life Cycles
    • Customer Portal Labs
    • Red Hat JBoss Supported Configurations
    • Red Hat Insights
Or troubleshoot an issue.

Select Your Language

  • English
  • Français
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat OpenStack Platform
  • Red Hat OpenShift
  • Red Hat OpenShift AI
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat build of Keycloak
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Application Foundations
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
All Products
Red Hat Product Errata RHSA-2019:1238 - Security Advisory
Issued:
2019-05-16
Updated:
2019-05-16

RHSA-2019:1238 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Critical: java-1.8.0-ibm security update

Type/Severity

Security Advisory: Critical

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP35.

Security Fix(es):

  • IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf() (CVE-2018-12547)
  • IBM JDK: missing null check when accelerating Unsafe calls (CVE-2018-12549)
  • Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D) (CVE-2019-2697)
  • OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698)
  • OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)
  • OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)
  • OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)
  • IBM JDK: Read beyond the end of bytecode array causing JVM crash (CVE-2019-10245)
  • libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)
  • Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment) (CVE-2019-2449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le

Fixes

  • BZ - 1579973 - CVE-2018-11212 libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c
  • BZ - 1665945 - CVE-2019-2422 OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290)
  • BZ - 1685601 - CVE-2019-2449 Oracle JDK: unspecified vulnerability fixed in 8u201 (Deployment)
  • BZ - 1685611 - CVE-2018-12547 IBM JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()
  • BZ - 1685717 - CVE-2018-12549 IBM JDK: missing null check when accelerating Unsafe calls
  • BZ - 1700440 - CVE-2019-2602 OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936)
  • BZ - 1700447 - CVE-2019-2698 OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022)
  • BZ - 1700564 - CVE-2019-2684 OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)
  • BZ - 1704480 - CVE-2019-2697 Oracle JDK: Unspecified vulnerability fixed in 7u221 and 8u211 (2D)
  • BZ - 1704799 - CVE-2019-10245 IBM JDK: Read beyond the end of bytecode array causing JVM crash

CVEs

  • CVE-2018-11212
  • CVE-2018-12547
  • CVE-2018-12549
  • CVE-2019-2422
  • CVE-2019-2449
  • CVE-2019-2602
  • CVE-2019-2684
  • CVE-2019-2697
  • CVE-2019-2698
  • CVE-2019-10245

References

  • https://access.redhat.com/security/updates/classification/#critical
Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 8

SRPM
x86_64
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 477d42a8ebe0fb441e99c98672305a90bfdaa8e1170d12a78284202cd9633b49
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b9ff108a04cdc7d91ad472c0484a4e34a502bf022159f50639f6ea57005e4e79
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 254423804cc82af03fd5e76b6bde0b646d9cb67375fad1398af88fb702c5e4d7
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 765d22de418ba69c729ddbd312c318690e15645e0459cc26aedf759f385647ec
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b38e2cfeca8dae57c811e1625c402765df0d2ce719553678c0b20ab4af901b85
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 3458f1be6e38c5b4e46a5dd5c81391485e85bca4fbeae39802d6bf576c577dc7
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 0acd32dbf1816319a167e18f9029bedd3d8969e4ae2b5d5e0fbb57231997f46d
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: c85ee51e1213aa19b57bb3e104297b56a34ee16486ea55e90f2afc82732aa511

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8

SRPM
x86_64
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 477d42a8ebe0fb441e99c98672305a90bfdaa8e1170d12a78284202cd9633b49
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b9ff108a04cdc7d91ad472c0484a4e34a502bf022159f50639f6ea57005e4e79
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 254423804cc82af03fd5e76b6bde0b646d9cb67375fad1398af88fb702c5e4d7
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 765d22de418ba69c729ddbd312c318690e15645e0459cc26aedf759f385647ec
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b38e2cfeca8dae57c811e1625c402765df0d2ce719553678c0b20ab4af901b85
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 3458f1be6e38c5b4e46a5dd5c81391485e85bca4fbeae39802d6bf576c577dc7
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 0acd32dbf1816319a167e18f9029bedd3d8969e4ae2b5d5e0fbb57231997f46d
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: c85ee51e1213aa19b57bb3e104297b56a34ee16486ea55e90f2afc82732aa511

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
x86_64
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 477d42a8ebe0fb441e99c98672305a90bfdaa8e1170d12a78284202cd9633b49
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b9ff108a04cdc7d91ad472c0484a4e34a502bf022159f50639f6ea57005e4e79
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 254423804cc82af03fd5e76b6bde0b646d9cb67375fad1398af88fb702c5e4d7
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 765d22de418ba69c729ddbd312c318690e15645e0459cc26aedf759f385647ec
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: b38e2cfeca8dae57c811e1625c402765df0d2ce719553678c0b20ab4af901b85
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 3458f1be6e38c5b4e46a5dd5c81391485e85bca4fbeae39802d6bf576c577dc7
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: 0acd32dbf1816319a167e18f9029bedd3d8969e4ae2b5d5e0fbb57231997f46d
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.x86_64.rpm SHA-256: c85ee51e1213aa19b57bb3e104297b56a34ee16486ea55e90f2afc82732aa511

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
s390x
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 68d9956c892e4a4ace2267b0330ee05789b7aa8afa574283b83349444e1e1055
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 264af6b161981ef2bc4d94cce1c2b74bebe48a7a0147bbf6627548a1576fa58b
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 37bfb85af407b0ba2c75d897034ede37b2397357f3a4659455f8d814d7f3df13
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 2e456daa8ea7c18315fe77fc884976848b1fe5f02970a709e46538e2f62a516c
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: bd8fbd36e03c055dc2cafb6599b2a9a4d93566e90ecb6aa32dd974ec3142e3d4
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 485034e9eeee2d5d116255b0d55fac487257dfad43b503040a8a1eb6b596b289

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8

SRPM
s390x
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 68d9956c892e4a4ace2267b0330ee05789b7aa8afa574283b83349444e1e1055
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 264af6b161981ef2bc4d94cce1c2b74bebe48a7a0147bbf6627548a1576fa58b
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 37bfb85af407b0ba2c75d897034ede37b2397357f3a4659455f8d814d7f3df13
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 2e456daa8ea7c18315fe77fc884976848b1fe5f02970a709e46538e2f62a516c
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: bd8fbd36e03c055dc2cafb6599b2a9a4d93566e90ecb6aa32dd974ec3142e3d4
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 485034e9eeee2d5d116255b0d55fac487257dfad43b503040a8a1eb6b596b289

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
s390x
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 68d9956c892e4a4ace2267b0330ee05789b7aa8afa574283b83349444e1e1055
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 264af6b161981ef2bc4d94cce1c2b74bebe48a7a0147bbf6627548a1576fa58b
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 37bfb85af407b0ba2c75d897034ede37b2397357f3a4659455f8d814d7f3df13
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 2e456daa8ea7c18315fe77fc884976848b1fe5f02970a709e46538e2f62a516c
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: bd8fbd36e03c055dc2cafb6599b2a9a4d93566e90ecb6aa32dd974ec3142e3d4
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.s390x.rpm SHA-256: 485034e9eeee2d5d116255b0d55fac487257dfad43b503040a8a1eb6b596b289

Red Hat Enterprise Linux for Power, little endian 8

SRPM
ppc64le
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 21d85741a0911e934a3f2808487b006ef9b412553c9241e0a2b65996331e8d48
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: baf0ab9170944dfeaeaf069a8eaa1aa06f13e0066bfba64df040a8079633bb15
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: e4e92fae703404be740df3fa986e4898f2c01b8b95570a5c6bec2281e5278f2a
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 8fffe19bbfe5cc7ec3dbdf5ac4ff37fae9aa4d7c80e971276e5a56f0d641ede3
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: ecf04416d4aa03c8b7752108214edb4f5553713aa75f9846b75a860d3d954fd4
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: eaf6fd6bd1ce0336fb2a88faf676898163b05f03f89857a98029ade46d1f835f
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: f16e1f59711ec9552a6680a7ada9a22d9c16d9fc4286c79d0d3be86b19168da6
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: bdaf2ca03b340c6157bfa5ad3c59b534b403be27d48dc48469ddbc7efb261156

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8

SRPM
ppc64le
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 21d85741a0911e934a3f2808487b006ef9b412553c9241e0a2b65996331e8d48
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: baf0ab9170944dfeaeaf069a8eaa1aa06f13e0066bfba64df040a8079633bb15
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: e4e92fae703404be740df3fa986e4898f2c01b8b95570a5c6bec2281e5278f2a
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 8fffe19bbfe5cc7ec3dbdf5ac4ff37fae9aa4d7c80e971276e5a56f0d641ede3
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: ecf04416d4aa03c8b7752108214edb4f5553713aa75f9846b75a860d3d954fd4
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: eaf6fd6bd1ce0336fb2a88faf676898163b05f03f89857a98029ade46d1f835f
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: f16e1f59711ec9552a6680a7ada9a22d9c16d9fc4286c79d0d3be86b19168da6
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: bdaf2ca03b340c6157bfa5ad3c59b534b403be27d48dc48469ddbc7efb261156

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
ppc64le
java-1.8.0-ibm-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 21d85741a0911e934a3f2808487b006ef9b412553c9241e0a2b65996331e8d48
java-1.8.0-ibm-demo-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: baf0ab9170944dfeaeaf069a8eaa1aa06f13e0066bfba64df040a8079633bb15
java-1.8.0-ibm-devel-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: e4e92fae703404be740df3fa986e4898f2c01b8b95570a5c6bec2281e5278f2a
java-1.8.0-ibm-headless-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: 8fffe19bbfe5cc7ec3dbdf5ac4ff37fae9aa4d7c80e971276e5a56f0d641ede3
java-1.8.0-ibm-jdbc-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: ecf04416d4aa03c8b7752108214edb4f5553713aa75f9846b75a860d3d954fd4
java-1.8.0-ibm-plugin-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: eaf6fd6bd1ce0336fb2a88faf676898163b05f03f89857a98029ade46d1f835f
java-1.8.0-ibm-src-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: f16e1f59711ec9552a6680a7ada9a22d9c16d9fc4286c79d0d3be86b19168da6
java-1.8.0-ibm-webstart-1.8.0.5.35-3.el8_0.ppc64le.rpm SHA-256: bdaf2ca03b340c6157bfa5ad3c59b534b403be27d48dc48469ddbc7efb261156

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat LinkedIn YouTube Facebook X, formerly Twitter

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

Red Hat legal and privacy links

  • About Red Hat
  • Jobs
  • Events
  • Locations
  • Contact Red Hat
  • Red Hat Blog
  • Inclusion at Red Hat
  • Cool Stuff Store
  • Red Hat Summit
© 2025 Red Hat

Red Hat legal and privacy links

  • Privacy statement
  • Terms of use
  • All policies and guidelines
  • Digital accessibility