# CVE-2020-14556: java-11-openjdk-devel: The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Develop...

CVE-2020-14556 is fixed in 39 products on 1 platform, first by openjdk-11-demo 11.0.8+10-0ubuntu1~18.04.1, released July 13, 2020. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2020-14556
- Priority: Routine
- CVSS: 4.8 (Important)
- EPSS: 0.0302
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 13, 2020

## Description

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.  Security Fix(es):  * OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920) (CVE-2020-14583)  * OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593)  * OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117) (CVE-2020-14556)  * OpenJDK: Excessive memory usage in ImageIO TIFF plugin (ImageIO, 8233239) (CVE-2020-14562)  * OpenJDK: Incomplete interface type checks in Graal compiler (Hotspot, 8236867) (CVE-2020-14573)  * OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature (JAXP, 8242136) (CVE-2020-14621)  * OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592) (CVE-2020-14577)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  Enhancement(s):  * Add -static-libs subpackage with statically linked OpenJDK libraries (BZ#1848701)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | java-1.8.0-ibm RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-demo RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-devel RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-headless RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-jdbc RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-plugin RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-src RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-ibm-webstart RHEL 8 | 1:1.8.0.6.15-1.el8_2 | [RHSA-2020:3386](https://patchblox.com/security/data/fix/linux/rhsa-2020-3386.md) | Aug 10, 2020 |
| Linux | java-1.8.0-openjdk RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-accessibility RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-accessibility ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-demo RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-demo ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-devel RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-devel ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-headless RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-headless ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-javadoc RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-javadoc ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-javadoc-zip RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-javadoc-zip ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-src RHEL 8 | 1:1.8.0.262.b10-0.el8_2 | [RHSA-2020:2972](https://patchblox.com/security/data/fix/linux/rhsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-1.8.0-openjdk-src ol 8 | 1:1.8.0.262.b10-0.el8_2 | [ELSA-2020-2972](https://patchblox.com/security/data/fix/linux/elsa-2020-2972.md) | Jul 16, 2020 |
| Linux | java-11-openjdk RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-demo RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-demo ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-devel RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-devel ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-headless RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-headless ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-javadoc RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-javadoc ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-javadoc-zip RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-javadoc-zip ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-jmods RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-jmods ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-src RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-src ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-static-libs RHEL 8 | 1:11.0.8.10-0.el8_2 | [RHSA-2020:2970](https://patchblox.com/security/data/fix/linux/rhsa-2020-2970.md) | Jul 16, 2020 |
| Linux | java-11-openjdk-static-libs ol 8 | 1:11.0.8.10-0.el8_2 | [ELSA-2020-2970](https://patchblox.com/security/data/fix/linux/elsa-2020-2970.md) | Jul 16, 2020 |
| Linux | openjdk-11-demo Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-demo 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-demo-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-demo Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-demo 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-demo-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-11-jdk Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-jdk 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jdk-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-jdk Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-jdk 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jdk-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-11-jdk-headless Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-jdk-headless 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jdk-headless-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-jdk-headless Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-jdk-headless 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jdk-headless-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-11-jre Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-jre 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jre-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-jre Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-jre 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jre-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-11-jre-headless Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-jre-headless 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jre-headless-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-jre-headless Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-jre-headless 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jre-headless-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-11-jre-zero Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-jre-zero 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jre-zero-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-jre-zero Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-jre-zero 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jre-zero-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-11-source Ubuntu 18.04.6 LTS (bionic) | 11.0.8+10-0ubuntu1~18.04.1 | [openjdk-11-source 11.0.8+10-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-source-11.0.8-10-0ubuntu1-18.04.1.md) | Jul 13, 2020 |
| Linux | openjdk-11-source Ubuntu 20.04 LTS (focal) | 11.0.8+10-0ubuntu1~20.04 | [openjdk-11-source 11.0.8+10-0ubuntu1~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-source-11.0.8-10-0ubuntu1-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-demo Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-demo 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-demo-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-demo Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-demo 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-demo-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jdk Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-jdk 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jdk-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jdk Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-jdk 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-jdk-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jdk-headless Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-jdk-headless 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jdk-headless-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jdk-headless Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-jdk-headless 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-jdk-headless-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jre Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-jre 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jre-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jre Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-jre 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-jre-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jre-headless Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-jre-headless 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jre-headless-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jre-headless Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-jre-headless 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-jre-headless-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jre-zero Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-jre-zero 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jre-zero-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-jre-zero Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-jre-zero 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-jre-zero-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-source Ubuntu 18.04.6 LTS (bionic) | 8u265-b01-0ubuntu2~18.04 | [openjdk-8-source 8u265-b01-0ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-source-8u265-b01-0ubuntu2-18.04.md) | Jul 13, 2020 |
| Linux | openjdk-8-source Ubuntu 20.04 LTS (focal) | 8u265-b01-0ubuntu2~20.04 | [openjdk-8-source 8u265-b01-0ubuntu2~20.04](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-8-source-8u265-b01-0ubuntu2-20.04.md) | Jul 13, 2020 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.