Jump to content
Compatible Support Forums
Sign in to follow this  
news

[Tech ARP] Hard Disk Drive Performance Comparison Guide Rev. 5.4

Recommended Posts

SUSE Security Update: Security update for IBM Java

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2014:1526-1

Rating: important

References: #904889

Cross-References: CVE-2014-3065 CVE-2014-3566 CVE-2014-4288

CVE-2014-6456 CVE-2014-6457 CVE-2014-6458

CVE-2014-6466 CVE-2014-6476 CVE-2014-6492

CVE-2014-6493 CVE-2014-6502 CVE-2014-6503

CVE-2014-6506 CVE-2014-6511 CVE-2014-6512

CVE-2014-6513 CVE-2014-6515 CVE-2014-6527

CVE-2014-6531 CVE-2014-6532 CVE-2014-6558

 

Affected Products:

SUSE Linux Enterprise Software Development Kit 11 SP3

SUSE Linux Enterprise Server 11 SP3 for VMware

SUSE Linux Enterprise Server 11 SP3

______________________________________________________________________________

 

An update that fixes 21 vulnerabilities is now available.

 

Description:

 

 

java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security

issues.

 

These security issues have been fixed:

 

* Unspecified vulnerability (CVE-2014-3065).

* The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other

products, uses nondeterministic CBC padding, which makes it easier

for man-in-the-middle attackers to obtain cleartext data via a

padding-oracle attack, aka the "POODLE" issue (CVE-2014-3566).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,

and Java SE Embedded 7u60, allows remote attackers to affect

confidentiality, integrity, and availability via vectors related to

AWT (CVE-2014-6513).

* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows

remote attackers to affect confidentiality, integrity, and

availability via unknown vectors (CVE-2014-6456).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20

allows remote attackers to affect confidentiality, integrity, and

availability via unknown vectors related to Deployment, a different

vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532

(CVE-2014-6503).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20

allows remote attackers to affect confidentiality, integrity, and

availability via unknown vectors related to Deployment, a different

vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503

(CVE-2014-6532).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20

allows remote attackers to affect confidentiality, integrity, and

availability via unknown vectors related to Deployment, a different

vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532

(CVE-2014-4288).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20

allows remote attackers to affect confidentiality, integrity, and

availability via unknown vectors related to Deployment, a different

vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532

(CVE-2014-6493).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,

when running on Firefox, allows remote attackers to affect

confidentiality, integrity, and availability via unknown vectors

related to Deployment (CVE-2014-6492).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20

allows local users to affect confidentiality, integrity, and

availability via unknown vectors related to Deployment

(CVE-2014-6458).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20,

when running on Internet Explorer, allows local users to affect

confidentiality, integrity, and availability via unknown vectors

related to Deployment (CVE-2014-6466).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20, and Java SE Embedded 7u60, allows remote attackers to affect

confidentiality, integrity, and availability via unknown vectors

related to Libraries (CVE-2014-6506).

* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows

remote attackers to affect integrity via unknown vectors related to

Deployment, a different vulnerability than CVE-2014-6527

(CVE-2014-6476).

* Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20

allows remote attackers to affect integrity via unknown vectors

related to Deployment (CVE-2014-6515).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20 allows remote attackers to affect confidentiality via unknown

vectors related to 2D (CVE-2014-6511).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20, and Java SE Embedded 7u60, allows remote attackers to affect

confidentiality via unknown vectors related to Libraries

(CVE-2014-6531).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows

remote attackers to affect integrity via unknown vectors related to

Libraries (CVE-2014-6512).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows

remote attackers to affect confidentiality and integrity via vectors

related to JSSE (CVE-2014-6457).

* Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows

remote attackers to affect integrity via unknown vectors related to

Deployment, a different vulnerability than CVE-2014-6476

(CVE-2014-6527).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20, and Java SE Embedded 7u60, allows remote attackers to affect

integrity via unknown vectors related to Libraries (CVE-2014-6502).

* Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and

8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3

allows remote attackers to affect integrity via unknown vectors

related to Security (CVE-2014-6558).

 

More information can be found at

http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_Nove

mber_2014

 

 

Security Issues:

 

* CVE-2014-3065

 

* CVE-2014-3566

 

* CVE-2014-6506

 

* CVE-2014-6511

 

* CVE-2014-6531

 

* CVE-2014-6512

 

* CVE-2014-6457

 

* CVE-2014-6502

 

* CVE-2014-6558

 

* CVE-2014-6513

 

* CVE-2014-6503

 

* CVE-2014-4288

 

* CVE-2014-6493

 

* CVE-2014-6532

 

* CVE-2014-6492

 

* CVE-2014-6458

 

* CVE-2014-6466

 

* CVE-2014-6515

 

* CVE-2014-6456

 

* CVE-2014-6476

 

* CVE-2014-6527

 

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Software Development Kit 11 SP3:

 

zypper in -t patch sdksp3-java-1_6_0-ibm-9992 sdksp3-java-1_7_0-ibm-9999

 

- SUSE Linux Enterprise Server 11 SP3 for VMware:

 

zypper in -t patch slessp3-java-1_6_0-ibm-9992 slessp3-java-1_7_0-ibm-9999

 

- SUSE Linux Enterprise Server 11 SP3:

 

zypper in -t patch slessp3-java-1_6_0-ibm-9992 slessp3-java-1_7_0-ibm-9999

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64):

 

java-1_6_0-ibm-devel-1.6.0_sr16.2-0.3.1

java-1_7_0-ibm-devel-1.7.0_sr8.0-0.5.1

 

- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64):

 

java-1_6_0-ibm-1.6.0_sr16.2-0.3.1

java-1_6_0-ibm-fonts-1.6.0_sr16.2-0.3.1

 

- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

 

java-1_6_0-ibm-1.6.0_sr16.2-0.3.1

java-1_6_0-ibm-fonts-1.6.0_sr16.2-0.3.1

java-1_6_0-ibm-jdbc-1.6.0_sr16.2-0.3.1

java-1_6_0-ibm-plugin-1.6.0_sr16.2-0.3.1

java-1_7_0-ibm-1.7.0_sr8.0-0.5.1

java-1_7_0-ibm-alsa-1.7.0_sr8.0-0.5.1

java-1_7_0-ibm-jdbc-1.7.0_sr8.0-0.5.1

java-1_7_0-ibm-plugin-1.7.0_sr8.0-0.5.1

 

- SUSE Linux Enterprise Server 11 SP3 for VMware (i586):

 

java-1_6_0-ibm-alsa-1.6.0_sr16.2-0.3.1

 

- SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64):

 

java-1_6_0-ibm-1.6.0_sr16.2-0.3.1

java-1_6_0-ibm-fonts-1.6.0_sr16.2-0.3.1

java-1_6_0-ibm-jdbc-1.6.0_sr16.2-0.3.1

java-1_7_0-ibm-1.7.0_sr8.0-0.5.1

java-1_7_0-ibm-jdbc-1.7.0_sr8.0-0.5.1

 

- SUSE Linux Enterprise Server 11 SP3 (i586 x86_64):

 

java-1_6_0-ibm-plugin-1.6.0_sr16.2-0.3.1

java-1_7_0-ibm-alsa-1.7.0_sr8.0-0.5.1

java-1_7_0-ibm-plugin-1.7.0_sr8.0-0.5.1

 

- SUSE Linux Enterprise Server 11 SP3 (i586):

 

java-1_6_0-ibm-alsa-1.6.0_sr16.2-0.3.1

 

 

References:

 

http://support.novell.com/security/cve/CVE-2014-3065.html

http://support.novell.com/security/cve/CVE-2014-3566.html

http://support.novell.com/security/cve/CVE-2014-4288.html

http://support.novell.com/security/cve/CVE-2014-6456.html

http://support.novell.com/security/cve/CVE-2014-6457.html

http://support.novell.com/security/cve/CVE-2014-6458.html

http://support.novell.com/security/cve/CVE-2014-6466.html

http://support.novell.com/security/cve/CVE-2014-6476.html

http://support.novell.com/security/cve/CVE-2014-6492.html

http://support.novell.com/security/cve/CVE-2014-6493.html

http://support.novell.com/security/cve/CVE-2014-6502.html

http://support.novell.com/security/cve/CVE-2014-6503.html

http://support.novell.com/security/cve/CVE-2014-6506.html

http://support.novell.com/security/cve/CVE-2014-6511.html

http://support.novell.com/security/cve/CVE-2014-6512.html

http://support.novell.com/security/cve/CVE-2014-6513.html

http://support.novell.com/security/cve/CVE-2014-6515.html

http://support.novell.com/security/cve/CVE-2014-6527.html

http://support.novell.com/security/cve/CVE-2014-6531.html

http://support.novell.com/security/cve/CVE-2014-6532.html

http://support.novell.com/security/cve/CVE-2014-6558.html

https://bugzilla.suse.com/show_bug.cgi?id=904889

http://download.suse.com/patch/finder/?keywords=47835bf177c54f65a9963dc0f95bf5a8

http://download.suse.com/patch/finder/?keywords=7276d3e6b69f3806941401a132b58c6b

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

 

 

 

 

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×