—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:011
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : java-1.7.0-openjdk
Date : January 20, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in
java-1.7.0-openjdk:

An input validation flaw was discovered in the font layout engine in
the 2D component. A specially crafted font file could trigger Java
Virtual Machine memory corruption when processed. An untrusted Java
application or applet could possibly use this flaw to bypass Java
sandbox restrictions (CVE-2013-5907).

Multiple improper permission check issues were discovered in the
CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass Java sandbox
restrictions (CVE-2014-0428, CVE-2014-0422, CVE-2013-5893).

Multiple improper permission check issues were discovered in the
Serviceability, Security, CORBA, JAAS, JAXP, and Networking components
in OpenJDK. An untrusted Java application or applet could use these
flaws to bypass certain Java sandbox restrictions (CVE-2014-0373,
CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884,
CVE-2014-0416, CVE-2014-0376, CVE-2014-0368).

It was discovered that the Beans component did not restrict processing
of XML external entities. This flaw could cause a Java application
using Beans to leak sensitive information, or affect application
availability (CVE-2014-0423).

It was discovered that the JSSE component could leak timing information
during the TLS/SSL handshake. This could possibly lead to disclosure
of information about the used encryption keys (CVE-2014-0411).

The updated packages provides a solution for these security issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5893
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025800.html
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
https://rhn.redhat.com/errata/RHSA-2014-0026.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
990636198d068d351db6fb422d8edd94 mbs1/x86_64/java-1.7.0-openjdk-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm
3e6f04b976359ce2aac53656fbc9580e mbs1/x86_64/java-1.7.0-openjdk-accessibility-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm
e053f2778cd70732f2f83ed8e3096253 mbs1/x86_64/java-1.7.0-openjdk-demo-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm
c1e9cf24972481dc56197f64b5cf16de mbs1/x86_64/java-1.7.0-openjdk-devel-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm
da3dc070c107b6bbce6e0496c903a03c mbs1/x86_64/java-1.7.0-openjdk-headless-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm
49d123d6368d5dc71dbb3a5cde2ae04f mbs1/x86_64/java-1.7.0-openjdk-javadoc-1.7.0.60-2.4.4.1.mbs1.noarch.rpm
fed79e054fcd7fc035d32f45399f3ff5 mbs1/x86_64/java-1.7.0-openjdk-src-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm
c0265b191a65f3f276359e541db1ccab mbs1/SRPMS/java-1.7.0-openjdk-1.7.0.60-2.4.4.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFS3TMRmqjQ0CJFipgRAv1kAKDPNZAoM8wndplIWake1EH9LESD9gCgo5CG
r/m9XhxlYl8sBv2MKW+tINU=
=6eSG
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________