Errata overview
Errata ID 580
Date 2020-05-06
Source package openjdk-8
Fixed in version 8u252-b09-1~deb9u1
Description
This update addresses the following issues:
* Misplaced regular expression syntax error check in RegExpScanner
  (Scripting, 8223898) (CVE-2020-2754)
* Incorrect handling of empty string nodes in regular expression Parser
  (Scripting, 8223904) (CVE-2020-2755)
* Incorrect handling of references to uninitialized class descriptors during
  deserialization (Serialization, 8224541) (CVE-2020-2756)
* Uncaught InstantiationError exception in ObjectStreamClass (Serialization,
  8224549) (CVE-2020-2757)
* Unexpected exceptions raised by DOMKeyInfoFactory and
  DOMXMLSignatureFactory (Security, 8231415) (CVE-2020-2773)
* Re-use of single TLS session for new connections (JSSE, 8234408)
  (CVE-2020-2781)
* CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server,
  8234825) (CVE-2020-2800)
* Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)
* Incorrect type checks in MethodType.readObject() (Libraries, 8235274)
  (CVE-2020-2805)
Additional notes
CVE ID CVE-2020-2754
CVE-2020-2755
CVE-2020-2756
CVE-2020-2757
CVE-2020-2773
CVE-2020-2781
CVE-2020-2800
CVE-2020-2803
CVE-2020-2805
UCS Bug number #51206