| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 20 Jan 2014 18:31:00 +0100 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2014:011 ] java-1.7.0-openjdk -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:011 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : java-1.7.0-openjdk Date : January 20, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been discovered and corrected in java-1.7.0-openjdk: An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions (CVE-2013-5907). Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2014-0428, CVE-2014-0422, CVE-2013-5893). Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368). It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability (CVE-2014-0423). It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys (CVE-2014-0411). The updated packages provides a solution for these security issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5893 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025800.html http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html https://rhn.redhat.com/errata/RHSA-2014-0026.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 990636198d068d351db6fb422d8edd94 mbs1/x86_64/java-1.7.0-openjdk-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm 3e6f04b976359ce2aac53656fbc9580e mbs1/x86_64/java-1.7.0-openjdk-accessibility-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm e053f2778cd70732f2f83ed8e3096253 mbs1/x86_64/java-1.7.0-openjdk-demo-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm c1e9cf24972481dc56197f64b5cf16de mbs1/x86_64/java-1.7.0-openjdk-devel-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm da3dc070c107b6bbce6e0496c903a03c mbs1/x86_64/java-1.7.0-openjdk-headless-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm 49d123d6368d5dc71dbb3a5cde2ae04f mbs1/x86_64/java-1.7.0-openjdk-javadoc-1.7.0.60-2.4.4.1.mbs1.noarch.rpm fed79e054fcd7fc035d32f45399f3ff5 mbs1/x86_64/java-1.7.0-openjdk-src-1.7.0.60-2.4.4.1.mbs1.x86_64.rpm c0265b191a65f3f276359e541db1ccab mbs1/SRPMS/java-1.7.0-openjdk-1.7.0.60-2.4.4.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFS3TMRmqjQ0CJFipgRAv1kAKDPNZAoM8wndplIWake1EH9LESD9gCgo5CG r/m9XhxlYl8sBv2MKW+tINU= =6eSG -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists