Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Ubuntu 12.04 LTS USN-2706-1 Critical OpenJDK 6 Denial Of Service

ubuntu
Calendar Grey August 6, 2015
Scroller Ubuntu
A range of vulnerabilities was resolved in OpenJDK 6 for Ubuntu, impacting cybersecurity and the reliability of data.
Several security issues were fixed in OpenJDK 6.

Summary

Several security issues were fixed in OpenJDK 6.

Software Description:

- openjdk-6: Open Source Java implementation

Details:

Several vulnerabilities were discovered in the OpenJDK JRE related to

information disclosure, data integrity, and availability. An attacker

could exploit these to cause a denial of service or expose sensitive

data over the network. (CVE-2015-2590, CVE-2015-2628, CVE-2015-4731,

CVE-2015-4732, CVE-2015-4733, CVE-2015-4760, CVE-2015-4748)

Several vulnerabilities were discovered in the cryptographic components

of the OpenJDK JRE. An attacker could exploit these to expose sensitive

data over the network. (CVE-2015-2601, CVE-2015-2808, CVE-2015-4000,

CVE-2015-2625, CVE-2015-2613)

As a security improvement, this update modifies OpenJDK behavior to

disable RC4 TLS/SSL cipher suites by default.

As a security improvement, this update modifies OpenJDK behavior to

reject DH key sizes below 768 bits by default, preventing a possible

downgrade attack.

Several vulner...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu information disclosure openjdk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  icedtea-6-jre-cacao             6b36-1.13.8-0ubuntu1~12.04
  icedtea-6-jre-jamvm             6b36-1.13.8-0ubuntu1~12.04
  openjdk-6-jdk                   6b36-1.13.8-0ubuntu1~12.04
  openjdk-6-jre                   6b36-1.13.8-0ubuntu1~12.04
  openjdk-6-jre-headless          6b36-1.13.8-0ubuntu1~12.04
  openjdk-6-jre-lib               6b36-1.13.8-0ubuntu1~12.04
  openjdk-6-jre-zero              6b36-1.13.8-0ubuntu1~12.04
  openjdk-6-source                6b36-1.13.8-0ubuntu1~12.04

This update uses a new upstream release, which includes additional
bug fixes. After a standard system update you need to restart any
Java applications or applets to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2706-1

CVE-2015-2590, CVE-2015-2601, CVE-2015-2621, CVE-2015-2625,

CVE-2015-2628, CVE-2015-2632, CVE-2015-2808, CVE-2015-4000,

CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4748,

CVE-2015-4749, CVE-2015-4760

Severity
critical
Lowest
Low
Medium
High
Critical

August 06, 2015

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu information disclosure openjdk

Package Information

https://launchpad.net/ubuntu/+source/openjdk-6/6b36-1.13.8-0ubuntu1~12.04

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.