[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: [ MDVSA-2014:141 ] java-1.7.0-openjdk
From: security () mandriva ! com
Date: 2014-07-29 17:43:00
Message-ID: E1XCBQS-0001RZ-AC () titan ! mandriva ! com
[Download RAW message or body]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2014:141
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : java-1.7.0-openjdk
Date : July 29, 2014
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Updated java-1.7.0-openjdk packages fix security vulnerabilities:
It was discovered that the Hotspot component in OpenJDK did not
properly verify bytecode from the class files. An untrusted Java
application or applet could possibly use these flaws to bypass Java
sandbox restrictions (CVE-2014-4216, CVE-2014-4219).
A format string flaw was discovered in the Hotspot component event
logger in OpenJDK. An untrusted Java application or applet could
use this flaw to crash the Java Virtual Machine or, potentially,
execute arbitrary code with the privileges of the Java Virtual Machine
(CVE-2014-2490).
Multiple improper permission check issues were discovered in the
Libraries component in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions
(CVE-2014-4223, CVE-2014-4262, CVE-2014-2483).
Multiple flaws were discovered in the JMX, Libraries, Security,
and Serviceability components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221,
CVE-2014-4252, CVE-2014-4266).
It was discovered that the RSA algorithm in the Security component
in OpenJDK did not sufficiently perform blinding while performing
operations that were using private keys. An attacker able to measure
timing differences of those operations could possibly leak information
about the used keys (CVE-2014-4244).
The Diffie-Hellman (DH) key exchange algorithm implementation in the
Security component in OpenJDK failed to validate public DH parameters
properly. This could cause OpenJDK to accept and use weak parameters,
allowing an attacker to recover the negotiated key (CVE-2014-4263).
This update is based on IcedTea version 2.5.1, which fixes these
issues, as well as several others.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
http://advisories.mageia.org/MGASA-2014-0292.html
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
6f3a09b012ab13f78c5c086dc13323dd \
mbs1/x86_64/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm \
bbc4a8e6155b94f75e5a68d72fd71cc4 \
mbs1/x86_64/java-1.7.0-openjdk-accessibility-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm \
249305659b449fd4bd313dc1467ed160 \
mbs1/x86_64/java-1.7.0-openjdk-demo-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm \
dd6ee50fb77c81d049aca83c043903c6 \
mbs1/x86_64/java-1.7.0-openjdk-devel-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm \
2dbbff1346376ce35aa19026168c282e \
mbs1/x86_64/java-1.7.0-openjdk-headless-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm \
c66fed21595279f83d2b79580db1971d \
mbs1/x86_64/java-1.7.0-openjdk-javadoc-1.7.0.65-2.5.1.1.mbs1.noarch.rpm \
4253ce0bc28cb2fa057585ac3cf18aa8 \
mbs1/x86_64/java-1.7.0-openjdk-src-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm \
8938dc4f0a7b5d7c67eb16f968c7a137 \
mbs1/SRPMS/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.src.rpm \
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFT17MJmqjQ0CJFipgRAo7RAKDRZYNj2a+GH6nyVnptjezozNLtZACfTT57
+jUAtHgs8GAqNujSkLlmZSY=
=DvBa
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic