Jump to content
Compatible Support Forums
Sign in to follow this  
news

[security-announce] SUSE-SU-2015:1320-1: important: Security update for java-1_7_0-openjdk

Recommended Posts

SUSE Security Update: Security update for java-1_7_0-openjdk

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2015:1320-1

Rating: important

References: #938248

Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597

CVE-2015-2601 CVE-2015-2613 CVE-2015-2619

CVE-2015-2621 CVE-2015-2625 CVE-2015-2627

CVE-2015-2628 CVE-2015-2632 CVE-2015-2637

CVE-2015-2638 CVE-2015-2664 CVE-2015-2808

CVE-2015-4000 CVE-2015-4729 CVE-2015-4731

CVE-2015-4732 CVE-2015-4733 CVE-2015-4736

CVE-2015-4748 CVE-2015-4749 CVE-2015-4760

 

Affected Products:

SUSE Linux Enterprise Desktop 11-SP4

SUSE Linux Enterprise Desktop 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP3

______________________________________________________________________________

 

An update that fixes 24 vulnerabilities is now available.

 

Description:

 

OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and

bugs.

 

The following vulnerabilities were fixed:

 

* CVE-2015-2590: Easily exploitable vulnerability in the Libraries

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized Operating System takeover including arbitrary

code execution.

* CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized update, insert or delete access to some Java

accessible data.

* CVE-2015-2597: Easily exploitable vulnerability in the Install component

requiring logon to Operating System. Successful attack of this

vulnerability could have resulted in unauthorized Operating System

takeover including arbitrary code execution.

* CVE-2015-2601: Easily exploitable vulnerability in the JCE component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2613: Easily exploitable vulnerability in the JCE component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java SE, Java SE Embedded

accessible data.

* CVE-2015-2619: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2621: Easily exploitable vulnerability in the JMX component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE

component allowed successful unauthenticated network attacks via

SSL/TLS. Successful attack of this vulnerability could have resulted in

unauthorized read access to a subset of Java accessible data.

* CVE-2015-2627: Very difficult to exploit vulnerability in the Install

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2628: Easily exploitable vulnerability in the CORBA component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-2632: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2637: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2638: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-2664: Difficult to exploit vulnerability in the Deployment

component requiring logon to Operating System. Successful attack of this

vulnerability could have resulted in unauthorized Operating System

takeover including arbitrary code execution.

* CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE

component allowed successful unauthenticated network attacks via

SSL/TLS. Successful attack of this vulnerability could have resulted in

unauthorized update, insert or delete access to some Java accessible

data as well as read access to a subset of Java accessible data.

* CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE

component allowed successful unauthenticated network attacks via

SSL/TLS. Successful attack of this vulnerability could have resulted in

unauthorized update, insert or delete access to some Java accessible

data as well as read access to a subset of Java Embedded accessible data.

* CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized update, insert or delete access to some Java SE

accessible data as well as read access to a subset of Java SE accessible

data.

* CVE-2015-4731: Easily exploitable vulnerability in the JMX component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-4732: Easily exploitable vulnerability in the Libraries

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized Operating System takeover including arbitrary

code execution.

* CVE-2015-4733: Easily exploitable vulnerability in the RMI component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-4736: Difficult to exploit vulnerability in the Deployment

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized Operating System takeover including arbitrary

code execution.

* CVE-2015-4748: Very difficult to exploit vulnerability in the Security

component allowed successful unauthenticated network attacks via OCSP.

Successful attack of this vulnerability could have resulted in

unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized ability to cause a partial denial of service (partial

DOS).

* CVE-2015-4760: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Desktop 11-SP4:

 

zypper in -t patch sledsp4-java-1_7_0-openjdk-12012=1

 

- SUSE Linux Enterprise Desktop 11-SP3:

 

zypper in -t patch sledsp3-java-1_7_0-openjdk-12012=1

 

- SUSE Linux Enterprise Debuginfo 11-SP4:

 

zypper in -t patch dbgsp4-java-1_7_0-openjdk-12012=1

 

- SUSE Linux Enterprise Debuginfo 11-SP3:

 

zypper in -t patch dbgsp3-java-1_7_0-openjdk-12012=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64):

 

java-1_7_0-openjdk-1.7.0.85-0.11.2

java-1_7_0-openjdk-demo-1.7.0.85-0.11.2

java-1_7_0-openjdk-devel-1.7.0.85-0.11.2

 

- SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64):

 

java-1_7_0-openjdk-1.7.0.85-0.11.2

java-1_7_0-openjdk-demo-1.7.0.85-0.11.2

java-1_7_0-openjdk-devel-1.7.0.85-0.11.2

 

- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):

 

java-1_7_0-openjdk-debuginfo-1.7.0.85-0.11.2

java-1_7_0-openjdk-debugsource-1.7.0.85-0.11.2

 

- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64):

 

java-1_7_0-openjdk-debuginfo-1.7.0.85-0.11.2

java-1_7_0-openjdk-debugsource-1.7.0.85-0.11.2

 

 

References:

 

https://www.suse.com/security/cve/CVE-2015-2590.html

https://www.suse.com/security/cve/CVE-2015-2596.html

https://www.suse.com/security/cve/CVE-2015-2597.html

https://www.suse.com/security/cve/CVE-2015-2601.html

https://www.suse.com/security/cve/CVE-2015-2613.html

https://www.suse.com/security/cve/CVE-2015-2619.html

https://www.suse.com/security/cve/CVE-2015-2621.html

https://www.suse.com/security/cve/CVE-2015-2625.html

https://www.suse.com/security/cve/CVE-2015-2627.html

https://www.suse.com/security/cve/CVE-2015-2628.html

https://www.suse.com/security/cve/CVE-2015-2632.html

https://www.suse.com/security/cve/CVE-2015-2637.html

https://www.suse.com/security/cve/CVE-2015-2638.html

https://www.suse.com/security/cve/CVE-2015-2664.html

https://www.suse.com/security/cve/CVE-2015-2808.html

https://www.suse.com/security/cve/CVE-2015-4000.html

https://www.suse.com/security/cve/CVE-2015-4729.html

https://www.suse.com/security/cve/CVE-2015-4731.html

https://www.suse.com/security/cve/CVE-2015-4732.html

https://www.suse.com/security/cve/CVE-2015-4733.html

https://www.suse.com/security/cve/CVE-2015-4736.html

https://www.suse.com/security/cve/CVE-2015-4748.html

https://www.suse.com/security/cve/CVE-2015-4749.html

https://www.suse.com/security/cve/CVE-2015-4760.html

https://bugzilla.suse.com/938248

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

 

 

 

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×