drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in OpenJDK
Name: |
Mehrere Probleme in OpenJDK |
|
ID: |
USN-3154-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 12.04 LTS |
|
Datum: |
Do, 8. Dezember 2016, 07:26 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5582
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5573
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5542
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5554 |
|
Applikationen: |
OpenJDK |
|
Originalnachricht |
--===============3617021699477905182== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="z3PcgjD2qOzdkXVS" Content-Disposition: inline
--z3PcgjD2qOzdkXVS Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-3154-1 December 08, 2016
openjdk-6 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in OpenJDK 6.
Software Description: - openjdk-6: Open Source Java implementation
Details:
It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. (CVE-2016-5542)
It was discovered that the JMX component of OpenJDK did not sufficiently perform classloader consistency checks. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5554)
It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could use this to send debugging commands to a Java application with debugging enabled. (CVE-2016-5573)
It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An attacker could use this to bypass Java sandbox restrictions. (CVE-2016-5582)
It was discovered that OpenJDK did not properly handle HTTP proxy authentication. An attacker could use this to expose HTTPS server authentication credentials. (CVE-2016-5597)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04 LTS: icedtea-6-jre-cacao 6b40-1.13.12-0ubuntu0.12.04.2 icedtea-6-jre-jamvm 6b40-1.13.12-0ubuntu0.12.04.2 openjdk-6-jdk 6b40-1.13.12-0ubuntu0.12.04.2 openjdk-6-jre 6b40-1.13.12-0ubuntu0.12.04.2 openjdk-6-jre-headless 6b40-1.13.12-0ubuntu0.12.04.2 openjdk-6-jre-lib 6b40-1.13.12-0ubuntu0.12.04.2
After a standard system update you need to restart any Java applications or applets to make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-3154-1 CVE-2016-5542, CVE-2016-5554, CVE-2016-5573, CVE-2016-5582, CVE-2016-5597
Package Information: https://launchpad.net/ubuntu/+source/openjdk-6/6b40-1.13.12-0ubuntu0.12.04.2
--z3PcgjD2qOzdkXVS Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJYSK5HAAoJEC8Jno0AXoH0V/cP/RMSxzL25Ws+lEyM1gbZnjwW W8/TLVhrLOwatHbMQVFSDE819Yl/qH63pKBionwWZeWpTLEC1cDDs9YV6dDE77Ss UTXp9HxJII/ItUL3HV9jk3KDzED3ojVWEFA9PkfmzPUQUqZ5gsCnG3Z+8DgwYBtK 8sZP+flzi0E8/WseQ2Z/2I07+Iqt54n0pyPhQoX1csIoYU2YMvlrbnPhdGM4iZvC //YJ5bzZVN9ssArr05ws3ZC1DgNehQ/cM0xZoYQFcrf+KwbweuNvo0kXEIOCaHwz nEMXz3ZDCBAaSwOicAIOQTewUgTNkdG77KnbNulJyCMFa2BlenuVj/7jjGbeA9I0 2zxmICZTSOMvHH3V0I9ONCqqoBTs0Eg5Q5D1mudvoP019JrKX3+bzR1iuEMXneVG JazOqcZ7/SnjNp1HJ483Urq0QM8osuPkh33c3529tZKananAArtqLWA9JzNqpjAn VUpDaMpGFS26duVNzA/E2n+4dQWiEGP6hWy36LX6/hoTgzh69jOU68Z4gQpUXFhP j24UgPFrO9jmBXMv1Lyw59UCbPWQDzohx6AglN29qFGzIFexSzNktMAIFebJ6WS0 fR8OW5wnojBziZr4yoEoPebsiTPsvDQGJA5+h7mAHOqAaVx+uG9Mpg/PqzwtYQrJ CVlkzdAtFGORU6ULHtc3 =uknM -----END PGP SIGNATURE-----
--z3PcgjD2qOzdkXVS--
--===============3617021699477905182== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============3617021699477905182==--
|
|
|
|