Gentoo: GLSA-201606-18: IcedTea: Multiple vulnerabilities
Summary
Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot, Libraries, and JAXP, exist which allows remote attackers to affect the confidentiality, integrity, and availability of vulnerable systems. Many of the vulnerabilities can only be exploited through sandboxed Java Web Start applications and java applets. Please review the CVE identifiers referenced below for details.
Resolution
Gentoo Security is no longer supporting dev-java/icedtea, as it has
been officially dropped from the stable tree.
Users of the IcedTea 3.x binary package should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-3.0.1"
Users of the IcedTea 7.x binary package should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-7.2.6.6"
References
[ 1 ] CVE-2016-0636 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0636 [ 2 ] CVE-2016-0636 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0636 [ 3 ] CVE-2016-0686 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0686 [ 4 ] CVE-2016-0687 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0687 [ 5 ] CVE-2016-0695 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0695 [ 6 ] CVE-2016-3422 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3422 [ 7 ] CVE-2016-3425 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3425 [ 8 ] CVE-2016-3427 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3427 [ 9 ] CVE-2016-3443 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3443 [ 10 ] CVE-2016-3449 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3449
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201606-18
Concerns
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
Synopsis
Multiple vulnerabilities have been found in IcedTea allowing remote attackers to affect confidentiality, integrity, and availability through various vectors.
Background
IcedTea’s aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions.
Affected Packages
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/icedtea-bin < 7.2.6.6-r1 *>= 3.0.1 >= 7.2.6.6-r1
Impact
===== Remote attackers may execute arbitrary code, compromise information, or cause Denial of Service.
Workaround
There is no known work around at this time.
