Debian: DSA-2420-1: openjdk-6 security update

    Date28 Feb 2012
    CategoryDebian
    41
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform. CVE-2011-3377
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-2420-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                            Florian Weimer
    February 28, 2012                      http://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : openjdk-6
    Vulnerability  : several
    Problem type   : remote
    Debian-specific: no
    CVE ID         : CVE-2011-3377 CVE-2011-3563 CVE-2011-5035 CVE-2012-0497
        	       	 CVE-2012-0501 CVE-2012-0502 CVE-2012-0503 CVE-2012-0505
    		 CVE-2012-0506 CVE-2012-0507
    
    Several vulnerabilities have been discovered in OpenJDK, an
    implementation of the Oracle Java platform.
    
    CVE-2011-3377
    	The Iced Tea browser plugin included in the openjdk-6 package
    	does not properly enforce the Same Origin Policy on web content
    	served under a domain name which has a common suffix with the
    	required domain name.
    
    CVE-2011-3563
    	The Java Sound component did not properly check for array
    	boundaries.  A malicious input or an untrusted Java application
    	or applet could use this flaw to cause Java Virtual Machine to
    	crash or disclose portion of its memory.
    
    CVE-2011-5035
    	The OpenJDK embedded web server did not guard against an
    	excessive number of a request parameters, leading to a denial
    	of service vulnerability involving hash collisions.
    
    CVE-2012-0497
    	It was discovered that Java2D did not properly check graphics
    	rendering objects before passing them to the native renderer.
    	This could lead to JVM crash or Java sandbox bypass.
    
    CVE-2012-0501
    	The ZIP central directory parser used by java.util.zip.ZipFile
    	entered an infinite recursion in native code when processing a
    	crafted ZIP file, leading to a denial of service.
    
    CVE-2012-0502
    	A flaw was found in the AWT KeyboardFocusManager class that
    	could allow untrusted Java applets to acquire keyboard focus
    	and possibly steal sensitive information.
    
    CVE-2012-0503
    	The java.util.TimeZone.setDefault() method lacked a security
    	manager invocation, allowing an untrusted Java application or
    	applet to set a new default time zone.
    
    CVE-2012-0505
    	The Java serialization code leaked references to serialization
    	exceptions, possibly leaking critical objects to untrusted
    	code in Java applets and applications.
    
    CVE-2012-0506
    	It was discovered that CORBA implementation in Java did not
    	properly protect repository identifiers (that can be obtained
    	using _ids() method) on certain Corba objects.  This could
    	have been used to perform modification of the data that should
    	have been immutable.
    
    CVE-2012-0507
    	The AtomicReferenceArray class implementation did not properly
    	check if the array is of an expected Object[] type.  A
    	malicious Java application or applet could use this flaw to
    	cause Java Virtual Machine to crash or bypass Java sandbox
    	restrictions
    
    For the stable distribution (squeeze), these problems have been fixed in
    version 6b18-1.8.13-0+squeeze1.
    
    For the testing distribution (wheezy) and the unstable distribution
    (sid), these problems have been fixed in version 6b24-1.11.1-1.
    
    We recommend that you upgrade your openjdk-6 packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.