Jump to content
Compatible Support Forums
Sign in to follow this  
Followers 0
news

[security-announce] openSUSE-SU-2015:1289-1: important: Security update for java-1_8_0-openjdk

By news, in Upcoming News

Recommended Posts

news    28

news
Posted

openSUSE Security Update: Security update for java-1_8_0-openjdk

______________________________________________________________________________

 

Announcement ID: openSUSE-SU-2015:1289-1

Rating: important

References: #937828 #938248

Cross-References: CVE-2015-2590 CVE-2015-2597 CVE-2015-2601

CVE-2015-2613 CVE-2015-2619 CVE-2015-2621

CVE-2015-2625 CVE-2015-2627 CVE-2015-2628

CVE-2015-2632 CVE-2015-2637 CVE-2015-2638

CVE-2015-2659 CVE-2015-2664 CVE-2015-2808

CVE-2015-4000 CVE-2015-4729 CVE-2015-4731

CVE-2015-4732 CVE-2015-4733 CVE-2015-4736

CVE-2015-4748 CVE-2015-4749 CVE-2015-4760

 

Affected Products:

openSUSE 13.2

______________________________________________________________________________

 

An update that fixes 24 vulnerabilities is now available.

 

Description:

 

OpenJDK was updated to 2.6.1 - OpenJDK 8u51 to fix security issues and

bugs.

 

The following vulnerabilities were fixed:

 

* CVE-2015-2590: Easily exploitable vulnerability in the Libraries

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized Operating System takeover including arbitrary

code execution.

* CVE-2015-2597: Easily exploitable vulnerability in the Install component

requiring logon to Operating System. Successful attack of this

vulnerability could have resulted in unauthorized Operating System

takeover including arbitrary code execution.

* CVE-2015-2601: Easily exploitable vulnerability in the JCE component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2613: Easily exploitable vulnerability in the JCE component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java SE, Java SE Embedded

accessible data.

* CVE-2015-2619: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2621: Easily exploitable vulnerability in the JMX component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE

component allowed successful unauthenticated network attacks via

SSL/TLS. Successful attack of this vulnerability could have resulted in

unauthorized read access to a subset of Java accessible data.

* CVE-2015-2627: Very difficult to exploit vulnerability in the Install

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2628: Easily exploitable vulnerability in the CORBA component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-2632: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2637: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized read access to a subset of Java accessible data.

* CVE-2015-2638: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-2659: Easily exploitable vulnerability in the Security

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized ability to cause a partial denial of service

(partial DOS).

* CVE-2015-2664: Difficult to exploit vulnerability in the Deployment

component requiring logon to Operating System. Successful attack of this

vulnerability could have resulted in unauthorized Operating System

takeover including arbitrary code execution.

* CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE

component allowed successful unauthenticated network attacks via

SSL/TLS. Successful attack of this vulnerability could have resulted in

unauthorized update, insert or delete access to some Java accessible

data as well as read access to a subset of Java accessible data.

* CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE

component allowed successful unauthenticated network attacks via

SSL/TLS. Successful attack of this vulnerability could have resulted in

unauthorized update, insert or delete access to some Java accessible

data as well as read access to a subset of Java Embedded accessible data.

* CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized update, insert or delete access to some Java SE

accessible data as well as read access to a subset of Java SE accessible

data.

* CVE-2015-4731: Easily exploitable vulnerability in the JMX component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-4732: Easily exploitable vulnerability in the Libraries

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized Operating System takeover including arbitrary

code execution.

* CVE-2015-4733: Easily exploitable vulnerability in the RMI component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-4736: Difficult to exploit vulnerability in the Deployment

component allowed successful unauthenticated network attacks via

multiple protocols. Successful attack of this vulnerability could have

resulted in unauthorized Operating System takeover including arbitrary

code execution.

* CVE-2015-4748: Very difficult to exploit vulnerability in the Security

component allowed successful unauthenticated network attacks via OCSP.

Successful attack of this vulnerability could have resulted in

unauthorized Operating System takeover including arbitrary code

execution.

* CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized ability to cause a partial denial of service (partial

DOS).

* CVE-2015-4760: Easily exploitable vulnerability in the 2D component

allowed successful unauthenticated network attacks via multiple

protocols. Successful attack of this vulnerability could have resulted

in unauthorized Operating System takeover including arbitrary code

execution.

 

 

Patch Instructions:

 

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- openSUSE 13.2:

 

zypper in -t patch openSUSE-2015-512=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- openSUSE 13.2 (i586 x86_64):

 

java-1_8_0-openjdk-1.8.0.51-12.1

java-1_8_0-openjdk-accessibility-1.8.0.51-12.1

java-1_8_0-openjdk-debuginfo-1.8.0.51-12.1

java-1_8_0-openjdk-debugsource-1.8.0.51-12.1

java-1_8_0-openjdk-demo-1.8.0.51-12.1

java-1_8_0-openjdk-demo-debuginfo-1.8.0.51-12.1

java-1_8_0-openjdk-devel-1.8.0.51-12.1

java-1_8_0-openjdk-headless-1.8.0.51-12.1

java-1_8_0-openjdk-headless-debuginfo-1.8.0.51-12.1

java-1_8_0-openjdk-src-1.8.0.51-12.1

 

- openSUSE 13.2 (noarch):

 

java-1_8_0-openjdk-javadoc-1.8.0.51-12.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2015-2590.html

https://www.suse.com/security/cve/CVE-2015-2597.html

https://www.suse.com/security/cve/CVE-2015-2601.html

https://www.suse.com/security/cve/CVE-2015-2613.html

https://www.suse.com/security/cve/CVE-2015-2619.html

https://www.suse.com/security/cve/CVE-2015-2621.html

https://www.suse.com/security/cve/CVE-2015-2625.html

https://www.suse.com/security/cve/CVE-2015-2627.html

https://www.suse.com/security/cve/CVE-2015-2628.html

https://www.suse.com/security/cve/CVE-2015-2632.html

https://www.suse.com/security/cve/CVE-2015-2637.html

https://www.suse.com/security/cve/CVE-2015-2638.html

https://www.suse.com/security/cve/CVE-2015-2659.html

https://www.suse.com/security/cve/CVE-2015-2664.html

https://www.suse.com/security/cve/CVE-2015-2808.html

https://www.suse.com/security/cve/CVE-2015-4000.html

https://www.suse.com/security/cve/CVE-2015-4729.html

https://www.suse.com/security/cve/CVE-2015-4731.html

https://www.suse.com/security/cve/CVE-2015-4732.html

https://www.suse.com/security/cve/CVE-2015-4733.html

https://www.suse.com/security/cve/CVE-2015-4736.html

https://www.suse.com/security/cve/CVE-2015-4748.html

https://www.suse.com/security/cve/CVE-2015-4749.html

https://www.suse.com/security/cve/CVE-2015-4760.html

https://bugzilla.suse.com/937828

https://bugzilla.suse.com/938248

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

 

 

 

Share this post

Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  
Followers 0
Go To Topic Listing Upcoming News
×