You are here
Home > Preporuke > Nadogradnja za java-1.7.0-openjdk

Nadogradnja za java-1.7.0-openjdk

by ncert - 0
  • Detalji os-a: LSU
  • Važnost: URG
  • Operativni sustavi: L
  • Kategorije: LSU

openSUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2016:0268-1
Rating: critical
References: #939523 #960996 #962743
Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126
CVE-2015-8472 CVE-2016-0402 CVE-2016-0448
CVE-2016-0466 CVE-2016-0483 CVE-2016-0494

Affected Products:
openSUSE 13.2
______________________________________________________________________________

An update that fixes 9 vulnerabilities is now available.

Description:

java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues.
(bsc#962743)

– CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may
allow a protected method to be accessed
– CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996)
– CVE-2015-8126: Vulnerability in the AWT component related to
splashscreen displays
– CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix
– CVE-2016-0402: Vulnerability in the Networking component related to URL
processing
– CVE-2016-0448: Vulnerability in the JMX comonent related to attribute
processing
– CVE-2016-0466: Vulnerability in the JAXP component, related to limits
– CVE-2016-0483: Vulnerability in the AWT component related to image
decoding
– CVE-2016-0494: Vulnerability in 2D component related to font actions

The following bugs were fixed:

– bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move
libjavagtk to full package

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.2:

zypper in -t patch openSUSE-2016-107=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.2 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.95-16.1
java-1_7_0-openjdk-accessibility-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-devel-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-headless-1.7.0.95-16.1
java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-debugsource-1.7.0.95-16.1
java-1_7_0-openjdk-demo-1.7.0.95-16.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-devel-1.7.0.95-16.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-headless-1.7.0.95-16.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-16.1
java-1_7_0-openjdk-src-1.7.0.95-16.1

– openSUSE 13.2 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.95-16.1

References:

https://www.suse.com/security/cve/CVE-2015-4871.html
https://www.suse.com/security/cve/CVE-2015-7575.html
https://www.suse.com/security/cve/CVE-2015-8126.html
https://www.suse.com/security/cve/CVE-2015-8472.html
https://www.suse.com/security/cve/CVE-2016-0402.html
https://www.suse.com/security/cve/CVE-2016-0448.html
https://www.suse.com/security/cve/CVE-2016-0466.html
https://www.suse.com/security/cve/CVE-2016-0483.html
https://www.suse.com/security/cve/CVE-2016-0494.html
https://bugzilla.suse.com/939523
https://bugzilla.suse.com/960996
https://bugzilla.suse.com/962743

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

openSUSE Security Update: Security update for Java7
______________________________________________________________________________

Announcement ID: openSUSE-SU-2016:0272-1
Rating: important
References: #939523 #962743
Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126
CVE-2015-8472 CVE-2016-0402 CVE-2016-0448
CVE-2016-0466 CVE-2016-0483 CVE-2016-0494

Affected Products:
openSUSE 13.1
______________________________________________________________________________

An update that fixes 9 vulnerabilities is now available.

Description:

Update OpenJDK to 7u95 / IcedTea 2.6.4 including the following fixes:

* Security fixes
– S8059054, CVE-2016-0402: Better URL processing
– S8130710, CVE-2016-0448: Better attributes processing
– S8132210: Reinforce JMX collector internals
– S8132988: Better printing dialogues
– S8133962, CVE-2016-0466: More general limits
– S8137060: JMX memory management improvements
– S8139012: Better font substitutions
– S8139017, CVE-2016-0483: More stable image decoding
– S8140543, CVE-2016-0494: Arrange font actions
– S8143185: Cleanup for handling proxies
– S8143941, CVE-2015-8126, CVE-2015-8472: Update splashscreen displays
– S8144773, CVE-2015-7575: Further reduce use of MD5 (SLOTH)
– S8142882, CVE-2015-4871: rebinding of the receiver of a
DirectMethodHandle may allow a protected method to be accessed
* Import of OpenJDK 7 u95 build 0
– S7167988: PKIX CertPathBuilder in reverse mode doesn’t work if more
than one trust anchor is specified
– S8068761: [TEST_BUG]
java/nio/channels/ServerSocketChannel/AdaptServerSocket.java failed
with SocketTimeoutException
– S8074068: Cleanup in src/share/classes/sun/security/x509/
– S8075773: jps running as root fails after the fix of JDK-8050807
– S8081297: SSL Problem with Tomcat
– S8131181: Increment minor version of HSx for 7u95 and initialize the
build number
– S8132082: Let OracleUcrypto accept RSAPrivateKey
– S8134605: Partial rework of the fix for 8081297
– S8134861: XSLT: Extension func call cause exception if namespace URI
contains partial package name
– S8135307: CompletionFailure thrown when calling FieldDoc.type, if
the field’s type is missing
– S8138716: (tz) Support tzdata2015g
– S8140244: Port fix of JDK-8075773 to MacOSX
– S8141213: [Parfait]Potentially blocking function GetArrayLength
called in JNI critical region at line 239 of
jdk/src/share/native/sun/awt/image/jpeg/jpegdecoder.c in function
GET_ARRAYS
– S8141287: Add MD5 to jdk.certpath.disabledAlgorithms – Take 2
– S8142928: [TEST_BUG]
sun/security/provider/certpath/ReverseBuilder/ReverseBuild.java 8u71
failure
– S8143132: L10n resource file translation update
– S8144955: Wrong changes were pushed with 8143942
– S8145551: Test failed with Crash for Improved font lookups
– S8147466: Add -fno-strict-overflow to
IndicRearrangementProcessor{,2}.cpp
* Backports
– S8140244: Port fix of JDK-8075773 to AIX
– S8133196, PR2712, RH1251935: HTTPS hostname invalid issue with
InetAddress
– S8140620, PR2710: Find and load default.sf2 as the default soundbank
on Linux

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.1:

zypper in -t patch 2016-110=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.1 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.95-24.27.1
java-1_7_0-openjdk-accessibility-1.7.0.95-24.27.1
java-1_7_0-openjdk-debuginfo-1.7.0.95-24.27.1
java-1_7_0-openjdk-debugsource-1.7.0.95-24.27.1
java-1_7_0-openjdk-demo-1.7.0.95-24.27.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.27.1
java-1_7_0-openjdk-devel-1.7.0.95-24.27.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.27.1
java-1_7_0-openjdk-headless-1.7.0.95-24.27.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.27.1
java-1_7_0-openjdk-src-1.7.0.95-24.27.1

– openSUSE 13.1 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.95-24.27.1

References:

https://www.suse.com/security/cve/CVE-2015-4871.html
https://www.suse.com/security/cve/CVE-2015-7575.html
https://www.suse.com/security/cve/CVE-2015-8126.html
https://www.suse.com/security/cve/CVE-2015-8472.html
https://www.suse.com/security/cve/CVE-2016-0402.html
https://www.suse.com/security/cve/CVE-2016-0448.html
https://www.suse.com/security/cve/CVE-2016-0466.html
https://www.suse.com/security/cve/CVE-2016-0483.html
https://www.suse.com/security/cve/CVE-2016-0494.html
https://bugzilla.suse.com/939523
https://bugzilla.suse.com/962743

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

 

 

   openSUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2016:0279-1
Rating:             critical
References:         #939523 #960996 #962743
Cross-References:   CVE-2015-4871 CVE-2015-7575 CVE-2015-8126
                    CVE-2015-8472 CVE-2016-0402 CVE-2016-0448
                    CVE-2016-0466 CVE-2016-0483 CVE-2016-0494
                  
Affected Products:
                    openSUSE Leap 42.1
______________________________________________________________________________

   An update that fixes 9 vulnerabilities is now available.

Description:

   java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues.
   (bsc#962743)

   – CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may
     allow a protected method to be accessed
   – CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996)
   – CVE-2015-8126: Vulnerability in the AWT component related to
     splashscreen displays
   – CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix
   – CVE-2016-0402: Vulnerability in the Networking component related to URL
     processing
   – CVE-2016-0448: Vulnerability in the JMX comonent related to attribute
     processing
   – CVE-2016-0466: Vulnerability in the JAXP component, related to limits
   – CVE-2016-0483: Vulnerability in the AWT component related to image
     decoding
   – CVE-2016-0494: Vulnerability in 2D component related to font actions

   The following bugs were fixed:

   – bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move
     libjavagtk to full package

   This update was imported from the SUSE:SLE-12:Update update project.

Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   – openSUSE Leap 42.1:

      zypper in -t patch openSUSE-2016-115=1

   To bring your system up-to-date, use “zypper patch”.

Package List:

   – openSUSE Leap 42.1 (i586 x86_64):

      java-1_7_0-openjdk-1.7.0.95-25.1
      java-1_7_0-openjdk-accessibility-1.7.0.95-25.1
      java-1_7_0-openjdk-debuginfo-1.7.0.95-25.1
      java-1_7_0-openjdk-debugsource-1.7.0.95-25.1
      java-1_7_0-openjdk-demo-1.7.0.95-25.1
      java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-25.1
      java-1_7_0-openjdk-devel-1.7.0.95-25.1
      java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-25.1
      java-1_7_0-openjdk-headless-1.7.0.95-25.1
      java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-25.1
      java-1_7_0-openjdk-src-1.7.0.95-25.1

   – openSUSE Leap 42.1 (x86_64):

      java-1_7_0-openjdk-bootstrap-1.7.0.95-25.1
      java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.95-25.1
      java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.95-25.1
      java-1_7_0-openjdk-bootstrap-devel-1.7.0.95-25.1
      java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.95-25.1
      java-1_7_0-openjdk-bootstrap-headless-1.7.0.95-25.1
      java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.95-25.1

   – openSUSE Leap 42.1 (noarch):

      java-1_7_0-openjdk-javadoc-1.7.0.95-25.1

References:

   https://www.suse.com/security/cve/CVE-2015-4871.html
   https://www.suse.com/security/cve/CVE-2015-7575.html
   https://www.suse.com/security/cve/CVE-2015-8126.html
   https://www.suse.com/security/cve/CVE-2015-8472.html
   https://www.suse.com/security/cve/CVE-2016-0402.html
   https://www.suse.com/security/cve/CVE-2016-0448.html
   https://www.suse.com/security/cve/CVE-2016-0466.html
   https://www.suse.com/security/cve/CVE-2016-0483.html
   https://www.suse.com/security/cve/CVE-2016-0494.html
   https://bugzilla.suse.com/939523
   https://bugzilla.suse.com/960996
   https://bugzilla.suse.com/962743

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

 

AutorTomislav Protega
Cert idNCERT-REF-2016-01-0021-ADV
CveCVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494
ID izvornikaopenSUSE-SU-2016:0268-1 openSUSE-SU-2016:0272-1
ProizvodSecurity update for java-1_7_0-openjdk
Izvorhttp://www.suse.com
ncert
Top
More in Preporuke
Nadogradnja za java-1.8.0-openjdk

Izdana je nadogradnja koja otklanja ranjivosti u radu programskog paketa java-1_8_0-openjdk za openSUSE. Jedna ranjivost (CVE-2015-7575) odnosi se na neodbacivanje...

Close