SUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1319-1
Rating: important
References: #938248
Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597
CVE-2015-2601 CVE-2015-2613 CVE-2015-2619
CVE-2015-2621 CVE-2015-2625 CVE-2015-2627
CVE-2015-2628 CVE-2015-2632 CVE-2015-2637
CVE-2015-2638 CVE-2015-2664 CVE-2015-2808
CVE-2015-4000 CVE-2015-4729 CVE-2015-4731
CVE-2015-4732 CVE-2015-4733 CVE-2015-4736
CVE-2015-4748 CVE-2015-4749 CVE-2015-4760

Affected Products:
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
______________________________________________________________________________

An update that fixes 24 vulnerabilities is now available.

Description:

OpenJDK was updated to 2.6.1 – OpenJDK 7u85 to fix security issues and
bugs.

The following vulnerabilities were fixed:

* CVE-2015-2590: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java
accessible data.
* CVE-2015-2597: Easily exploitable vulnerability in the Install component
requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2601: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2613: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java SE, Java SE Embedded
accessible data.
* CVE-2015-2619: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2621: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized read access to a subset of Java accessible data.
* CVE-2015-2627: Very difficult to exploit vulnerability in the Install
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2628: Easily exploitable vulnerability in the CORBA component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2632: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2637: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2638: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2664: Difficult to exploit vulnerability in the Deployment
component requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java accessible data.
* CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java Embedded accessible data.
* CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java SE
accessible data as well as read access to a subset of Java SE accessible
data.
* CVE-2015-4731: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4732: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4733: Easily exploitable vulnerability in the RMI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4736: Difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4748: Very difficult to exploit vulnerability in the Security
component allowed successful unauthenticated network attacks via OCSP.
Successful attack of this vulnerability could have resulted in
unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized ability to cause a partial denial of service (partial
DOS).
* CVE-2015-4760: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Server 12:

zypper in -t patch SUSE-SLE-SERVER-12-2015-352=1

– SUSE Linux Enterprise Desktop 12:

zypper in -t patch SUSE-SLE-DESKTOP-12-2015-352=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64):

java-1_7_0-openjdk-1.7.0.85-18.2
java-1_7_0-openjdk-debuginfo-1.7.0.85-18.2
java-1_7_0-openjdk-debugsource-1.7.0.85-18.2
java-1_7_0-openjdk-demo-1.7.0.85-18.2
java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-18.2
java-1_7_0-openjdk-devel-1.7.0.85-18.2
java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-18.2
java-1_7_0-openjdk-headless-1.7.0.85-18.2
java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-18.2

– SUSE Linux Enterprise Desktop 12 (x86_64):

java-1_7_0-openjdk-1.7.0.85-18.2
java-1_7_0-openjdk-debuginfo-1.7.0.85-18.2
java-1_7_0-openjdk-debugsource-1.7.0.85-18.2
java-1_7_0-openjdk-headless-1.7.0.85-18.2
java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-18.2

References:

https://www.suse.com/security/cve/CVE-2015-2590.html
https://www.suse.com/security/cve/CVE-2015-2596.html
https://www.suse.com/security/cve/CVE-2015-2597.html
https://www.suse.com/security/cve/CVE-2015-2601.html
https://www.suse.com/security/cve/CVE-2015-2613.html
https://www.suse.com/security/cve/CVE-2015-2619.html
https://www.suse.com/security/cve/CVE-2015-2621.html
https://www.suse.com/security/cve/CVE-2015-2625.html
https://www.suse.com/security/cve/CVE-2015-2627.html
https://www.suse.com/security/cve/CVE-2015-2628.html
https://www.suse.com/security/cve/CVE-2015-2632.html
https://www.suse.com/security/cve/CVE-2015-2637.html
https://www.suse.com/security/cve/CVE-2015-2638.html
https://www.suse.com/security/cve/CVE-2015-2664.html
https://www.suse.com/security/cve/CVE-2015-2808.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://www.suse.com/security/cve/CVE-2015-4729.html
https://www.suse.com/security/cve/CVE-2015-4731.html
https://www.suse.com/security/cve/CVE-2015-4732.html
https://www.suse.com/security/cve/CVE-2015-4733.html
https://www.suse.com/security/cve/CVE-2015-4736.html
https://www.suse.com/security/cve/CVE-2015-4748.html
https://www.suse.com/security/cve/CVE-2015-4749.html
https://www.suse.com/security/cve/CVE-2015-4760.html
https://bugzilla.suse.com/938248

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1320-1
Rating: important
References: #938248
Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597
CVE-2015-2601 CVE-2015-2613 CVE-2015-2619
CVE-2015-2621 CVE-2015-2625 CVE-2015-2627
CVE-2015-2628 CVE-2015-2632 CVE-2015-2637
CVE-2015-2638 CVE-2015-2664 CVE-2015-2808
CVE-2015-4000 CVE-2015-4729 CVE-2015-4731
CVE-2015-4732 CVE-2015-4733 CVE-2015-4736
CVE-2015-4748 CVE-2015-4749 CVE-2015-4760

Affected Products:
SUSE Linux Enterprise Desktop 11-SP4
SUSE Linux Enterprise Desktop 11-SP3
SUSE Linux Enterprise Debuginfo 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________

An update that fixes 24 vulnerabilities is now available.

Description:

OpenJDK was updated to 2.6.1 – OpenJDK 7u85 to fix security issues and
bugs.

The following vulnerabilities were fixed:

* CVE-2015-2590: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java
accessible data.
* CVE-2015-2597: Easily exploitable vulnerability in the Install component
requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2601: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2613: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java SE, Java SE Embedded
accessible data.
* CVE-2015-2619: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2621: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized read access to a subset of Java accessible data.
* CVE-2015-2627: Very difficult to exploit vulnerability in the Install
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2628: Easily exploitable vulnerability in the CORBA component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2632: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2637: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2638: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2664: Difficult to exploit vulnerability in the Deployment
component requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java accessible data.
* CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java Embedded accessible data.
* CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java SE
accessible data as well as read access to a subset of Java SE accessible
data.
* CVE-2015-4731: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4732: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4733: Easily exploitable vulnerability in the RMI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4736: Difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4748: Very difficult to exploit vulnerability in the Security
component allowed successful unauthenticated network attacks via OCSP.
Successful attack of this vulnerability could have resulted in
unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized ability to cause a partial denial of service (partial
DOS).
* CVE-2015-4760: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Desktop 11-SP4:

zypper in -t patch sledsp4-java-1_7_0-openjdk-12012=1

– SUSE Linux Enterprise Desktop 11-SP3:

zypper in -t patch sledsp3-java-1_7_0-openjdk-12012=1

– SUSE Linux Enterprise Debuginfo 11-SP4:

zypper in -t patch dbgsp4-java-1_7_0-openjdk-12012=1

– SUSE Linux Enterprise Debuginfo 11-SP3:

zypper in -t patch dbgsp3-java-1_7_0-openjdk-12012=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.85-0.11.2
java-1_7_0-openjdk-demo-1.7.0.85-0.11.2
java-1_7_0-openjdk-devel-1.7.0.85-0.11.2

– SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.85-0.11.2
java-1_7_0-openjdk-demo-1.7.0.85-0.11.2
java-1_7_0-openjdk-devel-1.7.0.85-0.11.2

– SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):

java-1_7_0-openjdk-debuginfo-1.7.0.85-0.11.2
java-1_7_0-openjdk-debugsource-1.7.0.85-0.11.2

– SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64):

java-1_7_0-openjdk-debuginfo-1.7.0.85-0.11.2
java-1_7_0-openjdk-debugsource-1.7.0.85-0.11.2

References:

https://www.suse.com/security/cve/CVE-2015-2590.html
https://www.suse.com/security/cve/CVE-2015-2596.html
https://www.suse.com/security/cve/CVE-2015-2597.html
https://www.suse.com/security/cve/CVE-2015-2601.html
https://www.suse.com/security/cve/CVE-2015-2613.html
https://www.suse.com/security/cve/CVE-2015-2619.html
https://www.suse.com/security/cve/CVE-2015-2621.html
https://www.suse.com/security/cve/CVE-2015-2625.html
https://www.suse.com/security/cve/CVE-2015-2627.html
https://www.suse.com/security/cve/CVE-2015-2628.html
https://www.suse.com/security/cve/CVE-2015-2632.html
https://www.suse.com/security/cve/CVE-2015-2637.html
https://www.suse.com/security/cve/CVE-2015-2638.html
https://www.suse.com/security/cve/CVE-2015-2664.html
https://www.suse.com/security/cve/CVE-2015-2808.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://www.suse.com/security/cve/CVE-2015-4729.html
https://www.suse.com/security/cve/CVE-2015-4731.html
https://www.suse.com/security/cve/CVE-2015-4732.html
https://www.suse.com/security/cve/CVE-2015-4733.html
https://www.suse.com/security/cve/CVE-2015-4736.html
https://www.suse.com/security/cve/CVE-2015-4748.html
https://www.suse.com/security/cve/CVE-2015-4749.html
https://www.suse.com/security/cve/CVE-2015-4760.html
https://bugzilla.suse.com/938248

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
7e