—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:141
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : java-1.7.0-openjdk
Date : July 29, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated java-1.7.0-openjdk packages fix security vulnerabilities:

It was discovered that the Hotspot component in OpenJDK did not
properly verify bytecode from the class files. An untrusted Java
application or applet could possibly use these flaws to bypass Java
sandbox restrictions (CVE-2014-4216, CVE-2014-4219).

A format string flaw was discovered in the Hotspot component event
logger in OpenJDK. An untrusted Java application or applet could
use this flaw to crash the Java Virtual Machine or, potentially,
execute arbitrary code with the privileges of the Java Virtual Machine
(CVE-2014-2490).

Multiple improper permission check issues were discovered in the
Libraries component in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions
(CVE-2014-4223, CVE-2014-4262, CVE-2014-2483).

Multiple flaws were discovered in the JMX, Libraries, Security,
and Serviceability components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221,
CVE-2014-4252, CVE-2014-4266).

It was discovered that the RSA algorithm in the Security component
in OpenJDK did not sufficiently perform blinding while performing
operations that were using private keys. An attacker able to measure
timing differences of those operations could possibly leak information
about the used keys (CVE-2014-4244).

The Diffie-Hellman (DH) key exchange algorithm implementation in the
Security component in OpenJDK failed to validate public DH parameters
properly. This could cause OpenJDK to accept and use weak parameters,
allowing an attacker to recover the negotiated key (CVE-2014-4263).

This update is based on IcedTea version 2.5.1, which fixes these
issues, as well as several others.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
http://advisories.mageia.org/MGASA-2014-0292.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
6f3a09b012ab13f78c5c086dc13323dd mbs1/x86_64/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
bbc4a8e6155b94f75e5a68d72fd71cc4 mbs1/x86_64/java-1.7.0-openjdk-accessibility-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
249305659b449fd4bd313dc1467ed160 mbs1/x86_64/java-1.7.0-openjdk-demo-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
dd6ee50fb77c81d049aca83c043903c6 mbs1/x86_64/java-1.7.0-openjdk-devel-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
2dbbff1346376ce35aa19026168c282e mbs1/x86_64/java-1.7.0-openjdk-headless-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
c66fed21595279f83d2b79580db1971d mbs1/x86_64/java-1.7.0-openjdk-javadoc-1.7.0.65-2.5.1.1.mbs1.noarch.rpm
4253ce0bc28cb2fa057585ac3cf18aa8 mbs1/x86_64/java-1.7.0-openjdk-src-1.7.0.65-2.5.1.1.mbs1.x86_64.rpm
8938dc4f0a7b5d7c67eb16f968c7a137 mbs1/SRPMS/java-1.7.0-openjdk-1.7.0.65-2.5.1.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFT17MJmqjQ0CJFipgRAo7RAKDRZYNj2a+GH6nyVnptjezozNLtZACfTT57
+jUAtHgs8GAqNujSkLlmZSY=
=DvBa
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________