You are here
Home > Preporuke > Nadogradnja za java-1.7.0-openjdk

Nadogradnja za java-1.7.0-openjdk

  • Detalji os-a: LMV
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LMV

Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:141

Package : java-1.7.0-openjdk
Date : July 29, 2014
Affected: Business Server 1.0

Problem Description:

Updated java-1.7.0-openjdk packages fix security vulnerabilities:

It was discovered that the Hotspot component in OpenJDK did not
properly verify bytecode from the class files. An untrusted Java
application or applet could possibly use these flaws to bypass Java
sandbox restrictions (CVE-2014-4216, CVE-2014-4219).

A format string flaw was discovered in the Hotspot component event
logger in OpenJDK. An untrusted Java application or applet could
use this flaw to crash the Java Virtual Machine or, potentially,
execute arbitrary code with the privileges of the Java Virtual Machine

Multiple improper permission check issues were discovered in the
Libraries component in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions
(CVE-2014-4223, CVE-2014-4262, CVE-2014-2483).

Multiple flaws were discovered in the JMX, Libraries, Security,
and Serviceability components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221,
CVE-2014-4252, CVE-2014-4266).

It was discovered that the RSA algorithm in the Security component
in OpenJDK did not sufficiently perform blinding while performing
operations that were using private keys. An attacker able to measure
timing differences of those operations could possibly leak information
about the used keys (CVE-2014-4244).

The Diffie-Hellman (DH) key exchange algorithm implementation in the
Security component in OpenJDK failed to validate public DH parameters
properly. This could cause OpenJDK to accept and use weak parameters,
allowing an attacker to recover the negotiated key (CVE-2014-4263).

This update is based on IcedTea version 2.5.1, which fixes these
issues, as well as several others.


Updated Packages:

Mandriva Business Server 1/X86_64:
6f3a09b012ab13f78c5c086dc13323dd mbs1/x86_64/java-1.7.0-openjdk-
bbc4a8e6155b94f75e5a68d72fd71cc4 mbs1/x86_64/java-1.7.0-openjdk-accessibility-
249305659b449fd4bd313dc1467ed160 mbs1/x86_64/java-1.7.0-openjdk-demo-
dd6ee50fb77c81d049aca83c043903c6 mbs1/x86_64/java-1.7.0-openjdk-devel-
2dbbff1346376ce35aa19026168c282e mbs1/x86_64/java-1.7.0-openjdk-headless-
c66fed21595279f83d2b79580db1971d mbs1/x86_64/java-1.7.0-openjdk-javadoc-
4253ce0bc28cb2fa057585ac3cf18aa8 mbs1/x86_64/java-1.7.0-openjdk-src-
8938dc4f0a7b5d7c67eb16f968c7a137 mbs1/SRPMS/java-1.7.0-openjdk-

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver 0x22458A98

You can view other update advisories for Mandriva Linux at:

If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


To unsubscribe, send a email to
with this subject : unsubscribe security-announce
Want to buy your Pack or Services from Mandriva?
Go to

AutorTomislav Protega
Cert idNCERT-REF-2014-07-0001-ADV
CveCVE-2014-4216 CVE-2014-4219 CVE-2014-2490 CVE-2014-4223 CVE-2014-4262 CVE-2014-2483 CVE-2014-4209 CVE-2014-4218 CVE-2014-4221 CVE-2014-4252 CVE-2014-4266 CVE-2014-4244 CVE-2014-4263
ID izvornikaMDVSA-2014:141
More in Preporuke
Ranjivosti jezgre operacijskog sustava

Otkrivene su ranjivosti u jezgri operacijskog sustava Debian. Ranjivosti su pronađene u podsustavu ptrace, implementaciji SCTP-a i PPPoL2TP značajki. Potencijalni...