http://www.mandriva.com/en/
______________________________
Package : java-1.7.0-openjdk
Date : July 29, 2014
Affected: Business Server 1.0
______________________________
Problem Description:
Updated java-1.7.0-openjdk packages fix security vulnerabilities:
It was discovered that the Hotspot component in OpenJDK did not
properly verify bytecode from the class files. An untrusted Java
application or applet could possibly use these flaws to bypass Java
sandbox restrictions (CVE-2014-4216, CVE-2014-4219).
A format string flaw was discovered in the Hotspot component event
logger in OpenJDK. An untrusted Java application or applet could
use this flaw to crash the Java Virtual Machine or, potentially,
execute arbitrary code with the privileges of the Java Virtual Machine
(CVE-2014-2490).
Multiple improper permission check issues were discovered in the
Libraries component in OpenJDK. An untrusted Java application or
applet could use these flaws to bypass Java sandbox restrictions
(CVE-2014-4223, CVE-2014-4262, CVE-2014-2483).
Multiple flaws were discovered in the JMX, Libraries, Security,
and Serviceability components in OpenJDK. An untrusted Java
application or applet could use these flaws to bypass certain Java
sandbox restrictions (CVE-2014-4209, CVE-2014-4218, CVE-2014-4221,
CVE-2014-4252, CVE-2014-4266).
It was discovered that the RSA algorithm in the Security component
in OpenJDK did not sufficiently perform blinding while performing
operations that were using private keys. An attacker able to measure
timing differences of those operations could possibly leak information
about the used keys (CVE-2014-4244).
The Diffie-Hellman (DH) key exchange algorithm implementation in the
Security component in OpenJDK failed to validate public DH parameters
properly. This could cause OpenJDK to accept and use weak parameters,
allowing an attacker to recover the negotiated key (CVE-2014-4263).
This update is based on IcedTea version 2.5.1, which fixes these
issues, as well as several others.
______________________________
References:
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://cve.mitre.org/cgi-bin/
http://advisories.mageia.org/
______________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
6f3a09b012ab13f78c5c086dc13323
bbc4a8e6155b94f75e5a68d72fd71c
249305659b449fd4bd313dc1467ed1
dd6ee50fb77c81d049aca83c043903
2dbbff1346376ce35aa19026168c28
c66fed21595279f83d2b79580db197
4253ce0bc28cb2fa057585ac3cf18a
8938dc4f0a7b5d7c67eb16f968c7a1
______________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Komentarų nėra:
Rašyti komentarą