You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa java-1.8.0-ibm

Sigurnosni nedostaci programskog paketa java-1.8.0-ibm

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2018:2568-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2568
Issue date: 2018-08-27
CVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736
CVE-2018-1517 CVE-2018-1656 CVE-2018-2940
CVE-2018-2952 CVE-2018-2973 CVE-2018-12539
=====================================================================

1. Summary:

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
7 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client Supplementary (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) – x86_64
Red Hat Enterprise Linux Server Supplementary (v. 7) – ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 7) – x86_64

3. Description:

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP20.

Security Fix(es):

* IBM JDK: privilege escalation via insufficiently restricted access to
Attach API (CVE-2018-12539)

* openssl: BN_mod_exp may produce incorrect results on x86_64
(CVE-2017-3732)

* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)

* IBM JDK: DoS in the java.math component (CVE-2018-1517)

* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
(CVE-2018-1656)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (Libraries) (CVE-2018-2940)

* OpenJDK: insufficient index validation in PatternSyntaxException
getMessage() (Concurrency, 8199547) (CVE-2018-2952)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (JSSE) (CVE-2018-2973)

* OpenSSL: Double-free in DSA code (CVE-2016-0705)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank the OpenSSL project for reporting
CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the
original reporter of CVE-2016-0705.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take
effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1310596 – CVE-2016-0705 OpenSSL: Double-free in DSA code
1416856 – CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64
1509169 – CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
1600925 – CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)
1602145 – CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)
1602146 – CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries)
1618767 – CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API
1618869 – CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
1618871 – CVE-2018-1517 IBM JDK: DoS in the java.math component

6. Package List:

Red Hat Enterprise Linux Client Supplementary (v. 7):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 7):

ppc64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64.rpm

ppc64le:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm

s390x:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.s390x.rpm

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 7):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-0705
https://access.redhat.com/security/cve/CVE-2017-3732
https://access.redhat.com/security/cve/CVE-2017-3736
https://access.redhat.com/security/cve/CVE-2018-1517
https://access.redhat.com/security/cve/CVE-2018-1656
https://access.redhat.com/security/cve/CVE-2018-2940
https://access.redhat.com/security/cve/CVE-2018-2952
https://access.redhat.com/security/cve/CVE-2018-2973
https://access.redhat.com/security/cve/CVE-2018-12539
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBW4QI1dzjgjWX9erEAQgiBRAApZ4yMTz6VaYwLOqGPcoQdZzEkg64CARM
k1LrzpzgD6tRbaKya/LqvJvIhQlJ4LWs0AAlOM0VNrwdx8ntZ4lGHURqSM1Y14L/
TScLgA22CTbL4u+8BEOrsNCcjnp+5YALbfPv1DCdYvbRwi1J503w4ccwBfttb+1/
EaYh7nrWooa6R6qlkopmk1zprZGCgv3azYOqphcnrooeCC3ZqcBEWZNo/H1TnxWv
kXfgxmZS3Rq5399umMOuWh2HDme2tO1OWTdY1+REfZh0Ex5v1rqYm/s+8d2FrEWm
Oqk5Azstjt/l5OZfVg/WJd/iy1ob2m5yRUp5mhLFfkctIN/stxqbqLzO17dimdEn
mhBwG/IkaGkMqQgEEZ65SXNyS+kW7hS8P4F0BuzmHIfaO3ALpCWOczyyiKHPHMng
ZPYeV+roqRVeZ7TY8dfcUOh3eOKivfQBL921x4YdciCgPxBR7eRx8/aw8QL7VFot
CRFMkS36Q2YqgfP9XH06AZdUEVJp/dpB1/f+EtR8e6YDdHSSgJvoV9pP0S2DhWnA
o5V5efe12Jv3MQgiy5n0Ws4/mhcxthZSTcdBKQfyTsfqngCr1TTnGotN9GI1B0qe
XX7pry5RkLnq/l/0T4d6JJceMnK5n/DebajHM+4B1rWQZS+4KUPDN5rYuo4OkI6L
KZ2NcbK0Lfw=
=5oM3
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

 

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2018:2575-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2575
Issue date: 2018-08-28
CVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736
CVE-2018-1517 CVE-2018-1656 CVE-2018-2940
CVE-2018-2952 CVE-2018-2973 CVE-2018-12539
=====================================================================

1. Summary:

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) – i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) – x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) – i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) – i386, x86_64

3. Description:

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP20.

Security Fix(es):

* IBM JDK: privilege escalation via insufficiently restricted access to
Attach API (CVE-2018-12539)

* openssl: BN_mod_exp may produce incorrect results on x86_64
(CVE-2017-3732)

* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)

* IBM JDK: DoS in the java.math component (CVE-2018-1517)

* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
(CVE-2018-1656)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (Libraries) (CVE-2018-2940)

* OpenJDK: insufficient index validation in PatternSyntaxException
getMessage() (Concurrency, 8199547) (CVE-2018-2952)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (JSSE) (CVE-2018-2973)

* OpenSSL: Double-free in DSA code (CVE-2016-0705)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank the OpenSSL project for reporting
CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the
original reporter of CVE-2016-0705.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take
effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1310596 – CVE-2016-0705 OpenSSL: Double-free in DSA code
1416856 – CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64
1509169 – CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
1600925 – CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)
1602145 – CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)
1602146 – CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries)
1618767 – CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API
1618869 – CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
1618871 – CVE-2018-1517 IBM JDK: DoS in the java.math component

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm

x86_64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm

ppc64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.ppc64.rpm

s390x:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.s390x.rpm

x86_64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm

x86_64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-0705
https://access.redhat.com/security/cve/CVE-2017-3732
https://access.redhat.com/security/cve/CVE-2017-3736
https://access.redhat.com/security/cve/CVE-2018-1517
https://access.redhat.com/security/cve/CVE-2018-1656
https://access.redhat.com/security/cve/CVE-2018-2940
https://access.redhat.com/security/cve/CVE-2018-2952
https://access.redhat.com/security/cve/CVE-2018-2973
https://access.redhat.com/security/cve/CVE-2018-12539
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBW4WgLdzjgjWX9erEAQixyw//d2pemlb2TNR2kW3WlrxY0KBjUBM+PS4i
bQ8+SoNsct2XtVFq0oOfwAmYMn++pAY37yvvhUdefe5sAcUldDcJtLIgXbtISSXe
V5EdrLvQbv/rSxikOfccFzNI8GwJTgGiLpq8n9exHcSsY5cZevzukgRr6b+yQbnj
mcYEC3TB/CnulDac/Pt0VsS9AoFhwuX958/+EQdpMq1yOGqog6eM8U6x2btA4YSi
mcVD2hom6GuYMKq0oWDPWPry5hJePvbPM6GZw8pYdRvA1eKjp24M3mkWkkIEFw6U
aZCW6YXJuwMMJ4IYbF1Aofm3ab+R1VZXmPvzMHXRhVcRyZLvBzo1fZaw7ISX1ibV
FimDRrXLIJDudoS80DMVmbgQTL37U6pGAe6gV2JLtvtEZl02Sxq5PeRfuMME4qeP
rT+xyz0zjyIqTpxhAzAQJ28ZCrWDvRycCT5ZLwaPfxZ0+4cY1l58TMfYpdwIKJSC
M8HQccrNxQ8S/kSKexIT18mSQcMwOhDza6gV4hSiOQgI/xHW3sic78a7/74JnSBT
DgZuicAq73IWdYu67B04UzsZNsySSW6vs3BeYdfN5BnmK40NxrH5d5LMRV4xKmN+
HlkzX1CrDCBl9PtbQF0xpUGluvXCg1u2kzGHj4Dv7JP64bV1wXmLm5kwrPL/QZhv
8IL8kIZinC8=
=eoiE
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Top
More in Preporuke
Ranjivost jezgre operacijskog sustava većeg broja Cisco proizvoda

Otkrivena je ranjivost jezgre operacijskog sustava kod većeg broja Cisco proizvoda uzrokovana nedostatkom kod IP stoga korištenog od strane Linux...

Close