GHSA-f4px-hx4m-mgqh
Record from GitHub Advisory Database · Published May 14, 2022
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openjdk-11-openj9 | Chainguard | 0.53.0-r0 |
| openjdk-17-openj9 | Chainguard | 0.53.0-r0 |
| openjdk-8-openj9 | Chainguard | 0.53.0-r1 |
| openjdk-26-openj9 | Chainguard | 0.59.0-r1 |
| openjdk-21-openj9 | Chainguard | 0.48.0-r2 |
| openjdk-25-openj9 | Chainguard | 0.59.0-r1 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | openjdk-11-openj9 | 0 |
| chainguard | openjdk-17-openj9 | 0 |
| chainguard | openjdk-8-openj9 | 0 |
| chainguard | openjdk-26-openj9 | 0 |
| chainguard | openjdk-21-openj9 | 0 |
| chainguard | openjdk-25-openj9 | 0 |
Timeline
- May 14, 2022 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-f4px-hx4m-mgqh
vulnetix vdb fixes GHSA-f4px-hx4m-mgqhOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-f4px-hx4m-mgqh/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16527 url
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19386 url
- http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released url
- http://bugs.icu-project.org/trac/ticket/10107 url
- http://lists.apple.com/archives/security-announce/2013/Apr/msg00001.html url
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00001.html url
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00017.html url
- http://security.gentoo.org/glsa/glsa-201406-32.xml url
- http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html url
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19526 url
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124 url
- http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released url
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03898880 url
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00007.html url
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html url
- http://rhn.redhat.com/errata/RHSA-2013-1455.html url
- http://www.us-cert.gov/ncas/alerts/TA13-107A url
- https://nvd.nist.gov/vuln/detail/CVE-2013-2419 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=952656 url
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130 url
…and 15 more