drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in OpenJDK
Name: |
Mehrere Probleme in OpenJDK |
|
ID: |
USN-1505-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 10.04 LTS, Ubuntu 11.04, Ubuntu 11.10, Ubuntu 12.04 LTS |
|
Datum: |
Fr, 13. Juli 2012, 08:22 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1719
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1723
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1724
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1725 |
|
Applikationen: |
OpenJDK |
|
Originalnachricht |
--===============0553496765431700568== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GyRA7555PLgSTuth" Content-Disposition: inline
--GyRA7555PLgSTuth Content-Type: text/plain; charset=us-ascii Content-Disposition: inlin Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-1505-1 July 13, 2012
icedtea-web, openjdk-6 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in OpenJDK 6.
Software Description: - openjdk-6: Open Source Java implementation - icedtea-web: A web browser plugin to execute Java applets
Details:
It was discovered that multiple flaws existed in the CORBA (Common Object Request Broker Architecture) implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. (CVE-2012-1711, CVE-2012-1719)
It was discovered that multiple flaws existed in the OpenJDK font manager's layout lookup implementation. A attacker could specially craft a font file that could cause a denial of service through crashing the JVM (Java Virtual Machine) or possibly execute arbitrary code. (CVE-2012-1713)
It was discovered that the SynthLookAndFeel class from Swing in OpenJDK did not properly prevent access to certain UI elements from outside the current application context. An attacker could create a Java application or applet that used this flaw to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1716)
It was discovered that OpenJDK runtime library classes could create temporary files with insecure permissions. A local attacker could use this to gain access to sensitive information. (CVE-2012-1717)
It was discovered that OpenJDK did not handle CRLs (Certificate Revocation Lists) properly. A remote attacker could use this to gain access to sensitive information. (CVE-2012-1718)
It was discovered that the OpenJDK HotSpot Virtual Machine did not properly verify the bytecode of the class to be executed. A remote attacker could create a Java application or applet that used this to cause a denial of service through crashing the JVM or bypass Java sandbox restrictions. (CVE-2012-1723, CVE-2012-1725)
It was discovered that the OpenJDK XML (Extensible Markup Language) parser did not properly handle some XML documents. An attacker could create an XML document that caused a denial of service in a Java application or applet parsing the document. (CVE-2012-1724)
As part of this update, the IcedTea web browser applet plugin was updated for Ubuntu 10.04 LTS, Ubuntu 11.04, and Ubuntu 11.10.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: openjdk-6-jre 6b24-1.11.3-1ubuntu0.12.04.1
Ubuntu 11.10: icedtea-6-plugin 1.2-2ubuntu0.11.10.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.11.10.1
Ubuntu 11.04: icedtea-6-plugin 1.2-2ubuntu0.11.04.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.11.04.1
Ubuntu 10.04 LTS: icedtea-6-plugin 1.2-2ubuntu0.10.04.1 openjdk-6-jre 6b24-1.11.3-1ubuntu0.10.04.1
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-1505-1 CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725
Package Information: https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.3-1ubuntu0.12.04.1 https://launchpad.net/ubuntu/+source/icedtea-web/1.2-2ubuntu0.11.10.1 https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.3-1ubuntu0.11.10.1 https://launchpad.net/ubuntu/+source/icedtea-web/1.2-2ubuntu0.11.04.1 https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.3-1ubuntu0.11.04.1 https://launchpad.net/ubuntu/+source/icedtea-web/1.2-2ubuntu0.10.04.1 https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.3-1ubuntu0.10.04.1
--GyRA7555PLgSTuth Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBCgAGBQJP/2Z5AAoJEC8Jno0AXoH0JZMP+QH7N3s2nj86cuIJCPUZ4Xxi c4Ko+jW+3+EqK6aV1rdIjEDzh6BgMHVaCczj+n2e/ftpJyf2syN1r64jqYSMRFdV UtQmfQZFCyPD8mUhBY33kYK4tIvWmntRZyFzwKyaoPpGhJQQMA9zLSrxKB+oqD3M 34P14WCHo3BcEMUiqCB0pGKmmqA123JKG1e5EGI76mgQr2m/q04C65YP3dCbjBGv x/nh+4LHXYkPTXryDdQ02/gsfEsNk0Re4XSeGRPgH6xuWrnutph6iDDgDAFXnpkL 3NrFpP2bOFO5hIwbVsedkaylpa9huhstEvWBq92/88fBQsXtHh86cR3DI5MddMi4 EiuD9MEC0COgDDAlWADdEl/bLvXWHHjZnTPXaepwwBrXNzSJayYSYwIkyaDQ7Afr oMK3m1anHT/4oQAEVaRrSF57eG4fS8NjSfxSBv3VYHSGOUN/xc+hJ7be5Q9AQGdj aPTK4dB41RLTJ2fU1pxkhEsMMZZag3gkOrer/K1xHb34iwnoRH3jtsbst2tM7HbA n8KvxPkiGq7ez4PBsQpLshxJmo62r2x7uKNffpb+iBUzgUn8MQSMJ38+4GxVsA8V iJ0arv5BbpxotUhODr0H/EBIB4QCA2SRrC9KvrB3kV/RzGlbFiZuwEMwRs+JSaia QhlYDKZquBLrqG1UNzmW =JZdF -----END PGP SIGNATURE-----
--GyRA7555PLgSTuth--
--===============0553496765431700568== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============0553496765431700568==--
|
|
|
|