From stanley.cheong.kwan.phoong at intel.com  Fri Jun 21 06:44:59 2019
From: stanley.cheong.kwan.phoong at intel.com (Phoong, Stanley Cheong Kwan)
Date: Fri, 21 Jun 2019 06:44:59 +0000
Subject: OpenJDK mujs package dependency
Message-ID: <D96F06BD64D1F24F9889B3F9A334CF2706A72CC0@PGSMSX103.gar.corp.intel.com>

Hi,

I've discovered that OpenJDK 9, 10 and 11 contains mujs inside lib/modules.

Mujs is discovered to contain multiple vulnerabilities.
CVE-2019-11413
CVE-2019-11412
CVE-2019-11411
CVE-2016-9109
CVE-2016-9108
CVE-2016-7564
CVE-2016-7563
CVE-2016-10132
CVE-2017-5628
CVE-2017-5627
CVE-2016-10141
CVE-2016-10133

However, upon inspection, I could not determine nor find any traces of mujs nor mupdf inside OpenJDK9,10 and 11.

Does anyone know where is mujs or mupdf being included inside OpenJDK 9, 10 or 11?

Stanley Phoong