| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 29 Jul 2014 19:43:00 +0200 From: security@...driva.com To: bugtraq@...urityfocus.com Subject: [ MDVSA-2014:141 ] java-1.7.0-openjdk -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:141 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : java-1.7.0-openjdk Date : July 29, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated java-1.7.0-openjdk packages fix security vulnerabilities: It was discovered that the Hotspot component in OpenJDK did not properly verify bytecode from the class files. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions (CVE-2014-4216, CVE-2014-4219). A format string flaw was discovered in the Hotspot component event logger in OpenJDK. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine or, potentially, execute arbitrary code with the privileges of the Java Virtual Machine (CVE-2014-2490). Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions (CVE-2014-4223, CVE-2014-4262, CVE-2014-2483). Multiple flaws were discovered in the JMX, Libraries, Security, and Serviceability components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221, CVE-2014-4252, CVE-2014-4266). It was discovered that the RSA algorithm in the Security component in OpenJDK did not sufficiently perform blinding while performing operations that were using private keys. An attacker able to measure timing differences of those operations could possibly leak information about the used keys (CVE-2014-4244). The Diffie-Hellman (DH) key exchange algorithm implementation in the Security component in OpenJDK failed to validate public DH parameters properly. This could cause OpenJDK to accept and use weak parameters, allowing an attacker to recover the negotiated key (CVE-2014-4263). This update is based on IcedTea version 2.5.1, which fixes these issues, as well as several others. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266 http://advisories.mageia.org/MGASA-2014-0292.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 6f3a09b012ab13f78c5c086dc13323dd mbs1/x86_64/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm bbc4a8e6155b94f75e5a68d72fd71cc4 mbs1/x86_64/java-1.7.0-openjdk-accessibility-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm 249305659b449fd4bd313dc1467ed160 mbs1/x86_64/java-1.7.0-openjdk-demo-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm dd6ee50fb77c81d049aca83c043903c6 mbs1/x86_64/java-1.7.0-openjdk-devel-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm 2dbbff1346376ce35aa19026168c282e mbs1/x86_64/java-1.7.0-openjdk-headless-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm c66fed21595279f83d2b79580db1971d mbs1/x86_64/java-1.7.0-openjdk-javadoc-1.7.0.65-2.5.1.1.mbs1.noarch.rpm 4253ce0bc28cb2fa057585ac3cf18aa8 mbs1/x86_64/java-1.7.0-openjdk-src-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm 8938dc4f0a7b5d7c67eb16f968c7a137 mbs1/SRPMS/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFT17MJmqjQ0CJFipgRAo7RAKDRZYNj2a+GH6nyVnptjezozNLtZACfTT57 +jUAtHgs8GAqNujSkLlmZSY= =DvBa -----END PGP SIGNATURE-----
Powered by blists - more mailing lists