Ubuntu 11.10: USN-1263-1 Moderate: OpenJDK 6 and IcedTea-Web Issues

ubuntu

November 16, 2011

Multiple OpenJDK 6 and IcedTea-Web vulnerabilities have been fixed.

Summary

Multiple OpenJDK 6 and IcedTea-Web vulnerabilities have been fixed.

Software Description:

- icedtea-web: A web browser plugin to execute Java applets

- openjdk-6: Open Source Java implementation

- openjdk-6b18: Open Source Java implementation

Details:

Deepak Bhole discovered a flaw in the Same Origin Policy (SOP)

implementation in the IcedTea web browser plugin. This could allow a

remote attacker to open connections to certain hosts that should

not be permitted. (CVE-2011-3377)

Juliano Rizzo and Thai Duong discovered that the block-wise AES

encryption algorithm block-wise as used in TLS/SSL was vulnerable to

a chosen-plaintext attack. This could allow a remote attacker to view

confidential data. (CVE-2011-3389)

It was discovered that a type confusion flaw existed in the in

the Internet Inter-Orb Protocol (IIOP) deserialization code. A

remote attacker could use this to cause an untrusted application

or applet to execute arbitrary code by deserializing malicious

input. (CVE-2011...

Read the Full Advisory

Topics Covered

security advisory moderate arbitrary code execution ubuntu dos openjdk icedtea-web

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  icedtea-6-jre-cacao             6b23~pre11-0ubuntu1.11.10
  icedtea-6-jre-jamvm             6b23~pre11-0ubuntu1.11.10
  icedtea-netx                    1.1.3-1ubuntu1.1
  icedtea-plugin                  1.1.3-1ubuntu1.1
  openjdk-6-jre                   6b23~pre11-0ubuntu1.11.10
  openjdk-6-jre-headless          6b23~pre11-0ubuntu1.11.10
  openjdk-6-jre-lib               6b23~pre11-0ubuntu1.11.10
  openjdk-6-jre-zero              6b23~pre11-0ubuntu1.11.10

Ubuntu 11.04:
  icedtea-6-jre-cacao             6b22-1.10.4-0ubuntu1~11.04.1
  icedtea-6-jre-jamvm             6b22-1.10.4-0ubuntu1~11.04.1
  icedtea-netx                    1.1.1-0ubuntu1~11.04.2
  icedtea-plugin                  1.1.1-0ubuntu1~11.04.2
  openjdk-6-jre                   6b22-1.10.4-0ubuntu1~11.04.1
  openjdk-6-jre-headless          6b22-1.10.4-0ubuntu1~11.04.1
  openjdk-6-jre-lib               6b22-1.10.4-0ubuntu1~11.04.1
  openjdk-6-jre-zero              6b22-1.10.4-0ubuntu1~11.04.1

Ubuntu 10.10:
  icedtea-6-jre-cacao             6b20-1.9.10-0ubuntu1~10.10.2
  openjdk-6-demo                  6b20-1.9.10-0ubuntu1~10.10.2
  openjdk-6-jdk                   6b20-1.9.10-0ubuntu1~10.10.2
  openjdk-6-jre                   6b20-1.9.10-0ubuntu1~10.10.2
  openjdk-6-jre-headless          6b20-1.9.10-0ubuntu1~10.10.2
  openjdk-6-jre-lib               6b20-1.9.10-0ubuntu1~10.10.2
  openjdk-6-jre-zero              6b20-1.9.10-0ubuntu1~10.10.2

Ubuntu 10.04 LTS:
  icedtea-6-jre-cacao             6b20-1.9.10-0ubuntu1~10.04.2
  icedtea6-plugin                 6b20-1.9.10-0ubuntu1~10.04.2
  openjdk-6-demo                  6b20-1.9.10-0ubuntu1~10.04.2
  openjdk-6-jre                   6b20-1.9.10-0ubuntu1~10.04.2
  openjdk-6-jre-headless          6b20-1.9.10-0ubuntu1~10.04.2
  openjdk-6-jre-lib               6b20-1.9.10-0ubuntu1~10.04.2
  openjdk-6-jre-zero              6b20-1.9.10-0ubuntu1~10.04.2

After a standard system update you need to restart any Java applications
or applets to make all the necessary changes.