openSUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:0190-1
Rating: important
References: #914041
Cross-References: CVE-2014-3566 CVE-2014-6585 CVE-2014-6587
CVE-2014-6591 CVE-2014-6593 CVE-2014-6601
CVE-2015-0383 CVE-2015-0395 CVE-2015-0400
CVE-2015-0407 CVE-2015-0408 CVE-2015-0410
CVE-2015-0412
Affected Products:
openSUSE 13.2
______________________________________________________________________________

An update that fixes 13 vulnerabilities is now available.

Description:

OpenJDK was updated to 2.5.4 – OpenJDK 7u75 to fix security issues and
bugs:

* Security fixes
– S8046656: Update protocol support
– S8047125, CVE-2015-0395: (ref) More phantom object references
– S8047130: Fewer escapes from escape analysis
– S8048035, CVE-2015-0400: Ensure proper proxy protocols
– S8049253: Better GC validation
– S8050807, CVE-2015-0383: Better performing performance data handling
– S8054367, CVE-2015-0412: More references for endpoints
– S8055304, CVE-2015-0407: More boxing for DirectoryComboBoxModel
– S8055309, CVE-2015-0408: RMI needs better transportation considerations
– S8055479: TLAB stability
– S8055489, CVE-2014-6585: Better substitution formats
– S8056264, CVE-2014-6587: Multicast support improvements
– S8056276, CVE-2014-6591: Fontmanager feature improvements
– S8057555, CVE-2014-6593: Less cryptic cipher suite management
– S8058982, CVE-2014-6601: Better verification of an exceptional
invokespecial
– S8059485, CVE-2015-0410: Resolve parsing ambiguity
– S8061210, CVE-2014-3566: Issues in TLS

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.2:

zypper in -t patch openSUSE-2015-91

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.2 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.75-4.1
java-1_7_0-openjdk-accessibility-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-devel-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-headless-1.7.0.75-4.1
java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-debugsource-1.7.0.75-4.1
java-1_7_0-openjdk-demo-1.7.0.75-4.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-devel-1.7.0.75-4.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-headless-1.7.0.75-4.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.75-4.1
java-1_7_0-openjdk-src-1.7.0.75-4.1

– openSUSE 13.2 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.75-4.1

References:

http://support.novell.com/security/cve/CVE-2014-3566.html
http://support.novell.com/security/cve/CVE-2014-6585.html
http://support.novell.com/security/cve/CVE-2014-6587.html
http://support.novell.com/security/cve/CVE-2014-6591.html
http://support.novell.com/security/cve/CVE-2014-6593.html
http://support.novell.com/security/cve/CVE-2014-6601.html
http://support.novell.com/security/cve/CVE-2015-0383.html
http://support.novell.com/security/cve/CVE-2015-0395.html
http://support.novell.com/security/cve/CVE-2015-0400.html
http://support.novell.com/security/cve/CVE-2015-0407.html
http://support.novell.com/security/cve/CVE-2015-0408.html
http://support.novell.com/security/cve/CVE-2015-0410.html
http://support.novell.com/security/cve/CVE-2015-0412.html
https://bugzilla.suse.com/show_bug.cgi?id=914041

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org