openSUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0042-1
Rating: important
References: #1049305 #1049306 #1049307 #1049309 #1049310
#1049311 #1049312 #1049313 #1049314 #1049315
#1049316 #1049317 #1049318 #1049319 #1049320
#1049321 #1049322 #1049323 #1049324 #1049325
#1049326 #1049327 #1049328 #1049329 #1049330
#1049331 #1049332 #1052318 #1064071 #1064072
#1064073 #1064075 #1064077 #1064078 #1064079
#1064080 #1064081 #1064082 #1064083 #1064084
#1064085 #1064086
Cross-References: CVE-2016-10165 CVE-2016-9840 CVE-2016-9841
CVE-2016-9842 CVE-2016-9843 CVE-2017-10053
CVE-2017-10067 CVE-2017-10074 CVE-2017-10081
CVE-2017-10086 CVE-2017-10087 CVE-2017-10089
CVE-2017-10090 CVE-2017-10096 CVE-2017-10101
CVE-2017-10102 CVE-2017-10105 CVE-2017-10107
CVE-2017-10108 CVE-2017-10109 CVE-2017-10110
CVE-2017-10111 CVE-2017-10114 CVE-2017-10115
CVE-2017-10116 CVE-2017-10118 CVE-2017-10125
CVE-2017-10135 CVE-2017-10176 CVE-2017-10193
CVE-2017-10198 CVE-2017-10243 CVE-2017-10274
CVE-2017-10281 CVE-2017-10285 CVE-2017-10295
CVE-2017-10345 CVE-2017-10346 CVE-2017-10347
CVE-2017-10348 CVE-2017-10349 CVE-2017-10350
CVE-2017-10355 CVE-2017-10356 CVE-2017-10357
CVE-2017-10388
Affected Products:
openSUSE Leap 42.3
openSUSE Leap 42.2
______________________________________________________________________________

An update that fixes 46 vulnerabilities is now available.

Description:

This update for java-1_7_0-openjdk fixes the following issues:

Security issues fixed:

– CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084).
– CVE-2017-10274: Fix issue inside subcomponent Smart Card IO
(bsc#1064071).
– CVE-2017-10281: Fix issue inside subcomponent Serialization
(bsc#1064072).
– CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073).
– CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075).
– CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086).
– CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078).
– CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082).
– CVE-2017-10347: Fix issue inside subcomponent Serialization
(bsc#1064079).
– CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081).
– CVE-2017-10345: Fix issue inside subcomponent Serialization
(bsc#1064077).
– CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080).
– CVE-2017-10357: Fix issue inside subcomponent Serialization
(bsc#1064085).
– CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083).
– CVE-2017-10102: Fix incorrect handling of references in DGC
(bsc#1049316).
– CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader
(bsc#1049305).
– CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest
(bsc#1049306).
– CVE-2017-10081: Fix incorrect bracket processing in function signature
handling (bsc#1049309).
– CVE-2017-10087: Fix insufficient access control checks in
ThreadPoolExecutor (bsc#1049311).
– CVE-2017-10089: Fix insufficient access control checks in
ServiceRegistry (bsc#1049312).
– CVE-2017-10090: Fix insufficient access control checks in
AsynchronousChannelGroupImpl (bsc#1049313).
– CVE-2017-10096: Fix insufficient access control checks in XML
transformations (bsc#1049314).
– CVE-2017-10101: Fix unrestricted access to
com.sun.org.apache.xml.internal.resolver (bsc#1049315).
– CVE-2017-10107: Fix insufficient access control checks in ActivationID
(bsc#1049318).
– CVE-2017-10074: Fix integer overflows in range check loop predicates
(bsc#1049307).
– CVE-2017-10110: Fix insufficient access control checks in ImageWatched
(bsc#1049321).
– CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute
deserialization (bsc#1049319).
– CVE-2017-10109: Fix unbounded memory allocation in CodeSource
deserialization (bsc#1049320).
– CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE
(bsc#1049324).
– CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326).
– CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL
(bsc#1049325).
– CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328).
– CVE-2017-10176: Fix incorrect handling of certain EC points
(bsc#1049329).
– CVE-2017-10074: Fix integer overflows in range check loop predicates
(bsc#1049307).
– CVE-2017-10074: Fix integer overflows in range check loop predicates
(bsc#1049307).
– CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322).
– CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS
(bsc#1049332).
– CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment
(bsc#1049327).
– CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX
(bsc#1049323).
– CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment
(bsc#1049317).
– CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310).
– CVE-2017-10198: Fix incorrect enforcement of certificate path
restrictions (bsc#1049331).
– CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330).

Bug fixes:

– Drop Exec Shield workaround to fix crashes on recent kernels, where Exec
Shield is gone (bsc#1052318).

This update was imported from the SUSE:SLE-12:Update update project.

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-14=1

– openSUSE Leap 42.2:

zypper in -t patch openSUSE-2018-14=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE Leap 42.3 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.161-45.1
java-1_7_0-openjdk-accessibility-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-devel-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-headless-1.7.0.161-45.1
java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-debugsource-1.7.0.161-45.1
java-1_7_0-openjdk-demo-1.7.0.161-45.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-devel-1.7.0.161-45.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-headless-1.7.0.161-45.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.161-45.1
java-1_7_0-openjdk-src-1.7.0.161-45.1

– openSUSE Leap 42.3 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.161-45.1

– openSUSE Leap 42.2 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.161-42.6.1
java-1_7_0-openjdk-accessibility-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-devel-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-headless-1.7.0.161-42.6.1
java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-debugsource-1.7.0.161-42.6.1
java-1_7_0-openjdk-demo-1.7.0.161-42.6.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-devel-1.7.0.161-42.6.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-headless-1.7.0.161-42.6.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.161-42.6.1
java-1_7_0-openjdk-src-1.7.0.161-42.6.1

– openSUSE Leap 42.2 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.161-42.6.1

References:

https://www.suse.com/security/cve/CVE-2016-10165.html
https://www.suse.com/security/cve/CVE-2016-9840.html
https://www.suse.com/security/cve/CVE-2016-9841.html
https://www.suse.com/security/cve/CVE-2016-9842.html
https://www.suse.com/security/cve/CVE-2016-9843.html
https://www.suse.com/security/cve/CVE-2017-10053.html
https://www.suse.com/security/cve/CVE-2017-10067.html
https://www.suse.com/security/cve/CVE-2017-10074.html
https://www.suse.com/security/cve/CVE-2017-10081.html
https://www.suse.com/security/cve/CVE-2017-10086.html
https://www.suse.com/security/cve/CVE-2017-10087.html
https://www.suse.com/security/cve/CVE-2017-10089.html
https://www.suse.com/security/cve/CVE-2017-10090.html
https://www.suse.com/security/cve/CVE-2017-10096.html
https://www.suse.com/security/cve/CVE-2017-10101.html
https://www.suse.com/security/cve/CVE-2017-10102.html
https://www.suse.com/security/cve/CVE-2017-10105.html
https://www.suse.com/security/cve/CVE-2017-10107.html
https://www.suse.com/security/cve/CVE-2017-10108.html
https://www.suse.com/security/cve/CVE-2017-10109.html
https://www.suse.com/security/cve/CVE-2017-10110.html
https://www.suse.com/security/cve/CVE-2017-10111.html
https://www.suse.com/security/cve/CVE-2017-10114.html
https://www.suse.com/security/cve/CVE-2017-10115.html
https://www.suse.com/security/cve/CVE-2017-10116.html
https://www.suse.com/security/cve/CVE-2017-10118.html
https://www.suse.com/security/cve/CVE-2017-10125.html
https://www.suse.com/security/cve/CVE-2017-10135.html
https://www.suse.com/security/cve/CVE-2017-10176.html
https://www.suse.com/security/cve/CVE-2017-10193.html
https://www.suse.com/security/cve/CVE-2017-10198.html
https://www.suse.com/security/cve/CVE-2017-10243.html
https://www.suse.com/security/cve/CVE-2017-10274.html
https://www.suse.com/security/cve/CVE-2017-10281.html
https://www.suse.com/security/cve/CVE-2017-10285.html
https://www.suse.com/security/cve/CVE-2017-10295.html
https://www.suse.com/security/cve/CVE-2017-10345.html
https://www.suse.com/security/cve/CVE-2017-10346.html
https://www.suse.com/security/cve/CVE-2017-10347.html
https://www.suse.com/security/cve/CVE-2017-10348.html
https://www.suse.com/security/cve/CVE-2017-10349.html
https://www.suse.com/security/cve/CVE-2017-10350.html
https://www.suse.com/security/cve/CVE-2017-10355.html
https://www.suse.com/security/cve/CVE-2017-10356.html
https://www.suse.com/security/cve/CVE-2017-10357.html
https://www.suse.com/security/cve/CVE-2017-10388.html
https://bugzilla.suse.com/1049305
https://bugzilla.suse.com/1049306
https://bugzilla.suse.com/1049307
https://bugzilla.suse.com/1049309
https://bugzilla.suse.com/1049310
https://bugzilla.suse.com/1049311
https://bugzilla.suse.com/1049312
https://bugzilla.suse.com/1049313
https://bugzilla.suse.com/1049314
https://bugzilla.suse.com/1049315
https://bugzilla.suse.com/1049316
https://bugzilla.suse.com/1049317
https://bugzilla.suse.com/1049318
https://bugzilla.suse.com/1049319
https://bugzilla.suse.com/1049320
https://bugzilla.suse.com/1049321
https://bugzilla.suse.com/1049322
https://bugzilla.suse.com/1049323
https://bugzilla.suse.com/1049324
https://bugzilla.suse.com/1049325
https://bugzilla.suse.com/1049326
https://bugzilla.suse.com/1049327
https://bugzilla.suse.com/1049328
https://bugzilla.suse.com/1049329
https://bugzilla.suse.com/1049330
https://bugzilla.suse.com/1049331
https://bugzilla.suse.com/1049332
https://bugzilla.suse.com/1052318
https://bugzilla.suse.com/1064071
https://bugzilla.suse.com/1064072
https://bugzilla.suse.com/1064073
https://bugzilla.suse.com/1064075
https://bugzilla.suse.com/1064077
https://bugzilla.suse.com/1064078
https://bugzilla.suse.com/1064079
https://bugzilla.suse.com/1064080
https://bugzilla.suse.com/1064081
https://bugzilla.suse.com/1064082
https://bugzilla.suse.com/1064083
https://bugzilla.suse.com/1064084
https://bugzilla.suse.com/1064085
https://bugzilla.suse.com/1064086

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org