openSUSE Security Update: java-1_7_0-openjdk: security fix for remote exploit
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2012:1154-1
Rating:             critical
References:         #770040 #777499 
Cross-References:   CVE-2012-0547 CVE-2012-1682 CVE-2012-3136
                    CVE-2012-4681
Affected Products:
                    openSUSE 12.2
______________________________________________________________________________

   An update that fixes four vulnerabilities is now available.

Description:

   Java-1_7_0-openjdk was updated to fix a remote exploit
   (CVE-2012-4681).

   Also bugfixes were done:
   - fix build on ARM and i586
   - remove files that are no longer used


   - zero build can be enabled using rpmbuild (osc build)
   --with zero
   - add hotspot 2.1 needed for zero
   - fix filelist on %{ix86}

   * Security fixes
   - S7162476, CVE-2012-1682: XMLDecoder security issue via
   ClassFinder
   - S7194567, CVE-2012-3136: Improve long term persistence
   of java.beans objects
   - S7163201, CVE-2012-0547: Simplify toolkit internals
   references
   - RH852051, CVE-2012-4681, S7162473: Reintroduce
   PackageAccessible checks removed in  6788531.
   * OpenJDK
   - Fix Zero FTBFS issues with 2.3
   - S7180036: Build failure in Mac platform caused by fix #
   7163201
   - S7182135: Impossible to use some editors directly
   - S7183701: [TEST]
   closed/java/beans/security/TestClassFinder.java –
   compilation failed
   - S7185678:
   java/awt/Menu/NullMenuLabelTest/NullMenuLabelTest.java
   failed with NPE
   * Bug fixes
   - PR1149: Zero-specific patch files not being packaged
   - use icedtea tarball for build again, this led into
   following dropped files because the are already in the
   tarball and simplified %prep and %build
   - drop class-rewriter.tar.gz
   - drop systemtap-tapset.tar.gz
   - drop desktop-files.tar.gz
   - drop nss.cfg
   - drop pulseaudio.tar.gz
   - drop remove-intree-libraries.sh
   - add archives from icedtea7-forest-2.3 for openjdk,
   corba, jaxp, jaxws, jdk, langtools and hotspot
   - drop rhino.patch, pulse-soundproperties and systemtap
   patch
   - move gnome bridge patches before make as it's irritating
   to have the patch fail after openjdk is built
   - use explicit file attributes in %files sections to
   prevent the file permissions problems in a future (like
   bnc#770040)
   - changed version scheme, so it now matches Oracle Java
   1.7.0.6 == Java7 u 6

   - update to icedtea-2.3.1 / OpenJDK7 u6 (bnc#777499)
   * Security fixes
   - RH852051, CVE-2012-4681: Reintroduce PackageAccessible
   checks removed in  6788531.
   * Bug fixes
   - PR902: PulseAudioClip getMicrosecondsLength() returns
   length in milliseconds, not microseconds
   - PR986: IcedTea7 fails to build with IcedTea6 CACAO due
   to low max heapsize
   - PR1050: Stream objects not garbage collected
   - PR1119: Only add classes to rt-source-files.txt if the
   class (or one or more of its methods/fields) are
   actually missing from the boot JDK
   - PR1137: Allow JARs to be optionally compressed by
   setting COMPRESS_JARS
   * OpenJDK
   - Make dynamic support for GConf work again.
   - PR1095: Add configure option for -Werror
   - PR1101: Undefined symbols on GNU/Linux SPARC
   - PR1140: Unnecessary diz files should not be installed
   - S7192804, PR1138: Build should not install jvisualvm
   man page for OpenJDK
   * JamVM
   - ARMv6 armhf: Changes for Raspbian (Raspberry Pi)
   - PPC: Don't use lwsync if it isn't supported
   - X86: Generate machine-dependent stubs for i386
   - When suspending, ignore detached threads that have
   died, this prevents a user caused deadlock when an
   external thread has been attached to the VM via JNI and
   it has exited without detaching
   - Add missing REF_TO_OBJs for references passed from JNI,
   this enable JamVM to run Qt-Jambi
   - there are number of fixes in 2.3, see NEWS


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 12.2:

      zypper in -t patch openSUSE-2012-592

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 12.2 (i586 x86_64):

      java-1_7_0-openjdk-1.7.0.6-3.12.1
      java-1_7_0-openjdk-debuginfo-1.7.0.6-3.12.1
      java-1_7_0-openjdk-debugsource-1.7.0.6-3.12.1
      java-1_7_0-openjdk-demo-1.7.0.6-3.12.1
      java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.12.1
      java-1_7_0-openjdk-devel-1.7.0.6-3.12.1
      java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.12.1
      java-1_7_0-openjdk-javadoc-1.7.0.6-3.12.1
      java-1_7_0-openjdk-src-1.7.0.6-3.12.1


References:

   https://www.suse.com/security/cve/CVE-2012-0547.html
   https://www.suse.com/security/cve/CVE-2012-1682.html
   https://www.suse.com/security/cve/CVE-2012-3136.html
   https://www.suse.com/security/cve/CVE-2012-4681.html
   https://bugzilla.novell.com/770040
   https://bugzilla.novell.com/777499

--

openSUSE: 2012:1154-1: critical: java-1_7_0-openjdk

September 12, 2012
An update that fixes four vulnerabilities is now available.

Description

Java-1_7_0-openjdk was updated to fix a remote exploit (CVE-2012-4681). Also bugfixes were done: - fix build on ARM and i586 - remove files that are no longer used - zero build can be enabled using rpmbuild (osc build) --with zero - add hotspot 2.1 needed for zero - fix filelist on %{ix86} * Security fixes - S7162476, CVE-2012-1682: XMLDecoder security issue via ClassFinder - S7194567, CVE-2012-3136: Improve long term persistence of java.beans objects - S7163201, CVE-2012-0547: Simplify toolkit internals references - RH852051, CVE-2012-4681, S7162473: Reintroduce PackageAccessible checks removed in 6788531. * OpenJDK - Fix Zero FTBFS issues with 2.3 - S7180036: Build failure in Mac platform caused by fix # 7163201 - S7182135: Impossible to use some editors directly - S7183701: [TEST] closed/java/beans/security/TestClassFinder.java – compilation failed - S7185678: java/awt/Menu/NullMenuLabelTest/NullMenuLabelTest.java failed with NPE * Bug fixes - PR1149: Zero-specific patch files not being packaged - use icedtea tarball for build again, this led into following dropped files because the are already in the tarball and simplified %prep and %build - drop class-rewriter.tar.gz - drop systemtap-tapset.tar.gz - drop desktop-files.tar.gz - drop nss.cfg - drop pulseaudio.tar.gz - drop remove-intree-libraries.sh - add archives from icedtea7-forest-2.3 for openjdk, corba, jaxp, jaxws, jdk, langtools and hotspot - drop rhino.patch, pulse-soundproperties and systemtap patch - move gnome bridge patches before make as it's irritating to have the patch fail after openjdk is built - use explicit file attributes in %files sections to prevent the file permissions problems in a future (like bnc#770040) - changed version scheme, so it now matches Oracle Java 1.7.0.6 == Java7 u 6 - update to icedtea-2.3.1 / OpenJDK7 u6 (bnc#777499) * Security fixes - RH852051, CVE-2012-4681: Reintroduce PackageAccessible checks removed in 6788531. * Bug fixes - PR902: PulseAudioClip getMicrosecondsLength() returns length in milliseconds, not microseconds - PR986: IcedTea7 fails to build with IcedTea6 CACAO due to low max heapsize - PR1050: Stream objects not garbage collected - PR1119: Only add classes to rt-source-files.txt if the class (or one or more of its methods/fields) are actually missing from the boot JDK - PR1137: Allow JARs to be optionally compressed by setting COMPRESS_JARS * OpenJDK - Make dynamic support for GConf work again. - PR1095: Add configure option for -Werror - PR1101: Undefined symbols on GNU/Linux SPARC - PR1140: Unnecessary diz files should not be installed - S7192804, PR1138: Build should not install jvisualvm man page for OpenJDK * JamVM - ARMv6 armhf: Changes for Raspbian (Raspberry Pi) - PPC: Don't use lwsync if it isn't supported - X86: Generate machine-dependent stubs for i386 - When suspending, ignore detached threads that have died, this prevents a user caused deadlock when an external thread has been attached to the VM via JNI and it has exited without detaching - Add missing REF_TO_OBJs for references passed from JNI, this enable JamVM to run Qt-Jambi - there are number of fixes in 2.3, see NEWS

 

Patch

Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-592 To bring your system up-to-date, use "zypper patch".


Package List

- openSUSE 12.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-3.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.6-3.12.1 java-1_7_0-openjdk-debugsource-1.7.0.6-3.12.1 java-1_7_0-openjdk-demo-1.7.0.6-3.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.12.1 java-1_7_0-openjdk-devel-1.7.0.6-3.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.12.1 java-1_7_0-openjdk-javadoc-1.7.0.6-3.12.1 java-1_7_0-openjdk-src-1.7.0.6-3.12.1


References

https://www.suse.com/security/cve/CVE-2012-0547.html https://www.suse.com/security/cve/CVE-2012-1682.html https://www.suse.com/security/cve/CVE-2012-3136.html https://www.suse.com/security/cve/CVE-2012-4681.html https://bugzilla.novell.com/770040 https://bugzilla.novell.com/777499--


Severity
Announcement ID: openSUSE-SU-2012:1154-1
Rating: critical
Affected Products: openSUSE 12.2

Related News

Linux Mint 22: Elevating Security and Usability for Admins
3 - 5 min read
Linux Mint has has long been recognized as a versatile and user-friendly distribution and has earned great popularity among administrators and
Exim 4.98 Addresses Critical Vulnerabilities, Bolsters Email Server Security
2 - 4 min read
Exim is one of Unix-like systems' most widely used mail transfer agents. It's essential for email delivery and handling and is a significant part of
Recent OpenSSH RCE Bug Explained: Impact & Mitigations
2 - 4 min read
In an era where cybersecurity threats loom larger than ever, the discovery of a Remote Code Execution (RCE) vulnerability in OpenSSH by Qualys’
CVE-2024-4577: A Swiftly Weaponized Vulnerability for Ransomware Distribution
2 - 4 min read
Security researchers recently issued an update detailing how attackers are exploiting a PHP code execution vulnerability to spread TellYouThePass
Play Ransomware Group Unleashes New Threat on ESXi Environments: Analysis & Mitigation Strategies
3 - 5 min read
The Play ransomware group, well-known for its double-extortion tactics, recently unveiled a Linux variant targeting ESXi environments. This
Critical Linux Kernel Vulnerabilities Patched in Ubuntu Azure Systems
2 - 4 min read
Canonical has fixed several recently identified critical Linux kernel vulnerabilities in July 2024. These vulnerabilities primarily affect Microsoft
The Urgent Need for Secure Software Development: New Report Serves as a Wake-Up Call for the Industry
3 - 5 min read
The Linux Foundation and Open Source Security Foundation recently published a report entitled "Secure Software Development Education 2024
Severe Linux Kernel Privilege Escalation Bugs Could Compromise Entire Systems
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved