[security-announce] openSUSE-SU-2016:0272-1: important: Security update for Java7

[news 28]

openSUSE Security Update: Security update for Java7

______________________________________________________________________________

 

Announcement ID: openSUSE-SU-2016:0272-1

Rating: important

References: #939523 #962743

Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126

CVE-2015-8472 CVE-2016-0402 CVE-2016-0448

CVE-2016-0466 CVE-2016-0483 CVE-2016-0494

 

Affected Products:

openSUSE 13.1

______________________________________________________________________________

 

An update that fixes 9 vulnerabilities is now available.

 

Description:

 

Update OpenJDK to 7u95 / IcedTea 2.6.4 including the following fixes:

 

* Security fixes

- S8059054, CVE-2016-0402: Better URL processing

- S8130710, CVE-2016-0448: Better attributes processing

- S8132210: Reinforce JMX collector internals

- S8132988: Better printing dialogues

- S8133962, CVE-2016-0466: More general limits

- S8137060: JMX memory management improvements

- S8139012: Better font substitutions

- S8139017, CVE-2016-0483: More stable image decoding

- S8140543, CVE-2016-0494: Arrange font actions

- S8143185: Cleanup for handling proxies

- S8143941, CVE-2015-8126, CVE-2015-8472: Update splashscreen displays

- S8144773, CVE-2015-7575: Further reduce use of MD5 (SLOTH)

- S8142882, CVE-2015-4871: rebinding of the receiver of a

DirectMethodHandle may allow a protected method to be accessed

* Import of OpenJDK 7 u95 build 0

- S7167988: PKIX CertPathBuilder in reverse mode doesn't work if more

than one trust anchor is specified

- S8068761: [TEST_BUG]

java/nio/channels/ServerSocketChannel/AdaptServerSocket.java failed

with SocketTimeoutException

- S8074068: Cleanup in src/share/classes/sun/security/x509/

- S8075773: jps running as root fails after the fix of JDK-8050807

- S8081297: SSL Problem with Tomcat

- S8131181: Increment minor version of HSx for 7u95 and initialize the

build number

- S8132082: Let OracleUcrypto accept RSAPrivateKey

- S8134605: Partial rework of the fix for 8081297

- S8134861: XSLT: Extension func call cause exception if namespace URI

contains partial package name

- S8135307: CompletionFailure thrown when calling FieldDoc.type, if

the field's type is missing

- S8138716: (tz) Support tzdata2015g

- S8140244: Port fix of JDK-8075773 to MacOSX

- S8141213: [Parfait]Potentially blocking function GetArrayLength

called in JNI critical region at line 239 of

jdk/src/share/native/sun/awt/image/jpeg/jpegdecoder.c in function

GET_ARRAYS

- S8141287: Add MD5 to jdk.certpath.disabledAlgorithms - Take 2

- S8142928: [TEST_BUG]

sun/security/provider/certpath/ReverseBuilder/ReverseBuild.java 8u71

failure

- S8143132: L10n resource file translation update

- S8144955: Wrong changes were pushed with 8143942

- S8145551: Test failed with Crash for Improved font lookups

- S8147466: Add -fno-strict-overflow to

IndicRearrangementProcessor{,2}.cpp

* Backports

- S8140244: Port fix of JDK-8075773 to AIX

- S8133196, PR2712, RH1251935: HTTPS hostname invalid issue with

InetAddress

- S8140620, PR2710: Find and load default.sf2 as the default soundbank

on Linux

 

 

Patch Instructions:

 

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- openSUSE 13.1:

 

zypper in -t patch 2016-110=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- openSUSE 13.1 (i586 x86_64):

 

java-1_7_0-openjdk-1.7.0.95-24.27.1

java-1_7_0-openjdk-accessibility-1.7.0.95-24.27.1

java-1_7_0-openjdk-debuginfo-1.7.0.95-24.27.1

java-1_7_0-openjdk-debugsource-1.7.0.95-24.27.1

java-1_7_0-openjdk-demo-1.7.0.95-24.27.1

java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.27.1

java-1_7_0-openjdk-devel-1.7.0.95-24.27.1

java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.27.1

java-1_7_0-openjdk-headless-1.7.0.95-24.27.1

java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.27.1

java-1_7_0-openjdk-src-1.7.0.95-24.27.1

 

- openSUSE 13.1 (noarch):

 

java-1_7_0-openjdk-javadoc-1.7.0.95-24.27.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2015-4871.html

https://www.suse.com/security/cve/CVE-2015-7575.html

https://www.suse.com/security/cve/CVE-2015-8126.html

https://www.suse.com/security/cve/CVE-2015-8472.html

https://www.suse.com/security/cve/CVE-2016-0402.html

https://www.suse.com/security/cve/CVE-2016-0448.html

https://www.suse.com/security/cve/CVE-2016-0466.html

https://www.suse.com/security/cve/CVE-2016-0483.html

https://www.suse.com/security/cve/CVE-2016-0494.html

https://bugzilla.suse.com/939523

https://bugzilla.suse.com/962743

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org