You are here
Home > Preporuke > Nadogradnja za java-1_7_0-openjdk

Nadogradnja za java-1_7_0-openjdk

by ncert - 0

openSUSE Security Update: Security update for java-1_7_0-openjdk
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:1288-1
Rating: important
References: #937828 #938248
Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597
CVE-2015-2601 CVE-2015-2613 CVE-2015-2619
CVE-2015-2621 CVE-2015-2625 CVE-2015-2627
CVE-2015-2628 CVE-2015-2632 CVE-2015-2637
CVE-2015-2638 CVE-2015-2664 CVE-2015-2808
CVE-2015-4000 CVE-2015-4729 CVE-2015-4731
CVE-2015-4732 CVE-2015-4733 CVE-2015-4736
CVE-2015-4748 CVE-2015-4749 CVE-2015-4760

Affected Products:
openSUSE 13.2
openSUSE 13.1
______________________________________________________________________________

An update that fixes 24 vulnerabilities is now available.

Description:

OpenJDK was updated to 2.6.1 – OpenJDK 7u85 to fix security issues and
bugs.

The following vulnerabilities were fixed:

* CVE-2015-2590: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java
accessible data.
* CVE-2015-2597: Easily exploitable vulnerability in the Install component
requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2601: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2613: Easily exploitable vulnerability in the JCE component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java SE, Java SE Embedded
accessible data.
* CVE-2015-2619: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2621: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized read access to a subset of Java accessible data.
* CVE-2015-2627: Very difficult to exploit vulnerability in the Install
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2628: Easily exploitable vulnerability in the CORBA component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2632: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2637: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized read access to a subset of Java accessible data.
* CVE-2015-2638: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-2664: Difficult to exploit vulnerability in the Deployment
component requiring logon to Operating System. Successful attack of this
vulnerability could have resulted in unauthorized Operating System
takeover including arbitrary code execution.
* CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java accessible data.
* CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE
component allowed successful unauthenticated network attacks via
SSL/TLS. Successful attack of this vulnerability could have resulted in
unauthorized update, insert or delete access to some Java accessible
data as well as read access to a subset of Java Embedded accessible data.
* CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized update, insert or delete access to some Java SE
accessible data as well as read access to a subset of Java SE accessible
data.
* CVE-2015-4731: Easily exploitable vulnerability in the JMX component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4732: Easily exploitable vulnerability in the Libraries
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4733: Easily exploitable vulnerability in the RMI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4736: Difficult to exploit vulnerability in the Deployment
component allowed successful unauthenticated network attacks via
multiple protocols. Successful attack of this vulnerability could have
resulted in unauthorized Operating System takeover including arbitrary
code execution.
* CVE-2015-4748: Very difficult to exploit vulnerability in the Security
component allowed successful unauthenticated network attacks via OCSP.
Successful attack of this vulnerability could have resulted in
unauthorized Operating System takeover including arbitrary code
execution.
* CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized ability to cause a partial denial of service (partial
DOS).
* CVE-2015-4760: Easily exploitable vulnerability in the 2D component
allowed successful unauthenticated network attacks via multiple
protocols. Successful attack of this vulnerability could have resulted
in unauthorized Operating System takeover including arbitrary code
execution.

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.2:

zypper in -t patch openSUSE-2015-511=1

– openSUSE 13.1:

zypper in -t patch openSUSE-2015-511=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.2 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.85-10.2
java-1_7_0-openjdk-accessibility-1.7.0.85-10.2
java-1_7_0-openjdk-bootstrap-1.7.0.85-10.1
java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.85-10.1
java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.85-10.1
java-1_7_0-openjdk-bootstrap-devel-1.7.0.85-10.1
java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.85-10.1
java-1_7_0-openjdk-bootstrap-headless-1.7.0.85-10.1
java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.85-10.1
java-1_7_0-openjdk-debuginfo-1.7.0.85-10.2
java-1_7_0-openjdk-debugsource-1.7.0.85-10.2
java-1_7_0-openjdk-demo-1.7.0.85-10.2
java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-10.2
java-1_7_0-openjdk-devel-1.7.0.85-10.2
java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-10.2
java-1_7_0-openjdk-headless-1.7.0.85-10.2
java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-10.2
java-1_7_0-openjdk-src-1.7.0.85-10.2

– openSUSE 13.2 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.85-10.2

– openSUSE 13.1 (i586 x86_64):

java-1_7_0-openjdk-1.7.0.85-24.21.1
java-1_7_0-openjdk-accessibility-1.7.0.85-24.21.1
java-1_7_0-openjdk-debuginfo-1.7.0.85-24.21.1
java-1_7_0-openjdk-debugsource-1.7.0.85-24.21.1
java-1_7_0-openjdk-demo-1.7.0.85-24.21.1
java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-24.21.1
java-1_7_0-openjdk-devel-1.7.0.85-24.21.1
java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-24.21.1
java-1_7_0-openjdk-headless-1.7.0.85-24.21.1
java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-24.21.1
java-1_7_0-openjdk-src-1.7.0.85-24.21.1

– openSUSE 13.1 (noarch):

java-1_7_0-openjdk-javadoc-1.7.0.85-24.21.1

References:

https://www.suse.com/security/cve/CVE-2015-2590.html
https://www.suse.com/security/cve/CVE-2015-2596.html
https://www.suse.com/security/cve/CVE-2015-2597.html
https://www.suse.com/security/cve/CVE-2015-2601.html
https://www.suse.com/security/cve/CVE-2015-2613.html
https://www.suse.com/security/cve/CVE-2015-2619.html
https://www.suse.com/security/cve/CVE-2015-2621.html
https://www.suse.com/security/cve/CVE-2015-2625.html
https://www.suse.com/security/cve/CVE-2015-2627.html
https://www.suse.com/security/cve/CVE-2015-2628.html
https://www.suse.com/security/cve/CVE-2015-2632.html
https://www.suse.com/security/cve/CVE-2015-2637.html
https://www.suse.com/security/cve/CVE-2015-2638.html
https://www.suse.com/security/cve/CVE-2015-2664.html
https://www.suse.com/security/cve/CVE-2015-2808.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://www.suse.com/security/cve/CVE-2015-4729.html
https://www.suse.com/security/cve/CVE-2015-4731.html
https://www.suse.com/security/cve/CVE-2015-4732.html
https://www.suse.com/security/cve/CVE-2015-4733.html
https://www.suse.com/security/cve/CVE-2015-4736.html
https://www.suse.com/security/cve/CVE-2015-4748.html
https://www.suse.com/security/cve/CVE-2015-4749.html
https://www.suse.com/security/cve/CVE-2015-4760.html
https://bugzilla.suse.com/937828
https://bugzilla.suse.com/938248

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
7e

ncert
Top
More in Preporuke
Ranjivosti programskog paketa lxc

Otkrivene su dvije ranjivosti u programskom paketu lxc za Debian. Prva ranjivost posljedica je mogućnosti zaobilaženja direktorija prilikom stvaranja lock...

Close