[gentoo-announce] [ GLSA 201603-14 ] IcedTea: Multiple vulnerabilities

[news 28]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory GLSA 201603-14

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

https://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 

Severity: Normal

Title: IcedTea: Multiple vulnerabilities

Date: March 12, 2016

Bugs: #537940, #559532, #565842, #567850, #572716

ID: 201603-14

 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 

Synopsis

========

 

Multiple vulnerabilities have been found in IcedTea allowing remote

attackers to affect confidentiality, integrity, and availability

through various vectors.

 

Background

==========

 

IcedTea's aim is to provide OpenJDK in a form suitable for easy

configuration, compilation and distribution with the primary goal of

allowing inclusion in GNU/Linux distributions.

 

Affected packages

=================

 

-------------------------------------------------------------------

Package / Vulnerable / Unaffected

-------------------------------------------------------------------

1 dev-java/icedtea < 7.2.6.4 *>= 6.1.13.9

>= 7.2.6.4

2 dev-java/icedtea-bin < 7.2.6.4 *>= 6.1.13.9

>= 7.2.6.4

-------------------------------------------------------------------

2 affected packages

 

Description

===========

 

Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,

Libraries, and JAXP, exist which allows remote attackers to affect the

confidentiality, integrity, and availability of vulnerable systems.

This includes the possibility of remote execution of arbitrary code,

information disclosure, or Denial of Service. Many of the

vulnerabilities can only be exploited through sandboxed Java Web Start

applications and java applets. Please reference the CVEs listed for

specific details.

 

Impact

======

 

Remote attackers may remotely execute arbitrary code, compromise

information, or cause Denial of Service.

 

Workaround

==========

 

There is no known work around at this time.

 

Resolution

==========

 

IcedTea 7.x users should upgrade to the latest version:

 

# emerge --sync

# emerge --ask --oneshot --verbose ">=dev-java/icedtea-7.2.6.4"

 

IcedTea bin 7.x users should upgrade to the latest version:

 

# emerge --sync

# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-7.2.6.4"

 

IcedTea 6.x users should upgrade to the latest version:

 

# emerge --sync

# emerge --ask --oneshot --verbose ">=dev-java/icedtea-6.1.13.9"

 

IcedTea bin 6.x users should upgrade to the latest version:

 

# emerge --sync

# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-6.1.13.9"

 

References

==========

 

[ 1 ] CVE-2014-6585

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6585

[ 2 ] CVE-2014-6587

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6587

[ 3 ] CVE-2014-6591

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6591

[ 4 ] CVE-2014-6593

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6593

[ 5 ] CVE-2014-6601

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6601

[ 6 ] CVE-2015-0383

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0383

[ 7 ] CVE-2015-0395

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0395

[ 8 ] CVE-2015-0400

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0400

[ 9 ] CVE-2015-0407

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0407

[ 10 ] CVE-2015-0408

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0408

[ 11 ] CVE-2015-0412

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0412

[ 12 ] CVE-2015-2590

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2590

[ 13 ] CVE-2015-2601

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2601

[ 14 ] CVE-2015-2613

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2613

[ 15 ] CVE-2015-2621

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2621

[ 16 ] CVE-2015-2625

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2625

[ 17 ] CVE-2015-2628

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2628

[ 18 ] CVE-2015-2632

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2632

[ 19 ] CVE-2015-4731

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4731

[ 20 ] CVE-2015-4732

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4732

[ 21 ] CVE-2015-4733

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4733

[ 22 ] CVE-2015-4734

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4734

[ 23 ] CVE-2015-4748

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4748

[ 24 ] CVE-2015-4749

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4749

[ 25 ] CVE-2015-4760

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4760

[ 26 ] CVE-2015-4803

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4803

[ 27 ] CVE-2015-4805

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4805

[ 28 ] CVE-2015-4806

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4806

[ 29 ] CVE-2015-4835

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4835

[ 30 ] CVE-2015-4840

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4840

[ 31 ] CVE-2015-4842

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4842

[ 32 ] CVE-2015-4843

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4843

[ 33 ] CVE-2015-4844

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4844

[ 34 ] CVE-2015-4860

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4860

[ 35 ] CVE-2015-4871

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4871

[ 36 ] CVE-2015-4872

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4872

[ 37 ] CVE-2015-4881

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4881

[ 38 ] CVE-2015-4882

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4882

[ 39 ] CVE-2015-4883

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4883

[ 40 ] CVE-2015-4893

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4893

[ 41 ] CVE-2015-4903

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4903

[ 42 ] CVE-2015-4911

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4911

[ 43 ] CVE-2016-0402

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0402

[ 44 ] CVE-2016-0448

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0448

[ 45 ] CVE-2016-0466

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0466

[ 46 ] CVE-2016-0483

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0483

[ 47 ] CVE-2016-0494

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0494

 

Availability

============

 

This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:

 

https://security.gentoo.org/glsa/201603-14

 

Concerns?

=========

 

Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users' machines is of utmost

importance to us. Any security concerns should be addressed to

security ( -at -) gentoo.org or alternatively, you may file a bug at

https://bugs.gentoo.org.

 

License

=======

 

Copyright 2016 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).

 

The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.

 

http://creativecommons.org/licenses/by-sa/2.5