Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 15.10 & 14.04 LTS USN-2942-1 Critical OpenJDK Denial Of Service

ubuntu
Calendar Grey March 25, 2016
Scroller Ubuntu
Crucial OpenJDK 7 alert for Ubuntu users regarding a security vulnerability that impacts data accuracy and potential service disruptions.
OpenJDK could be made to crash or run programs as your login if it received specially crafted input.

Summary

OpenJDK could be made to crash or run programs as your login if it received

specially crafted input.

Software Description:

- openjdk-7: Open Source Java implementation

Details:

A vulnerability was discovered in the JRE related to information

disclosure, data integrity, and availability. An attacker could exploit

these to cause a denial of service, expose sensitive data over the network,

or possibly execute arbitrary code.

Topics%20covered

Topics Covered

security advisory denial of service security issue Ubuntu information disclosure Linux advisory OpenJDK

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  icedtea-7-jre-jamvm             7u95-2.6.4-0ubuntu0.15.10.2
  openjdk-7-jre                   7u95-2.6.4-0ubuntu0.15.10.2
  openjdk-7-jre-headless          7u95-2.6.4-0ubuntu0.15.10.2
  openjdk-7-jre-lib               7u95-2.6.4-0ubuntu0.15.10.2
  openjdk-7-jre-zero              7u95-2.6.4-0ubuntu0.15.10.2

Ubuntu 14.04 LTS:
  icedtea-7-jre-jamvm             7u95-2.6.4-0ubuntu0.14.04.2
  openjdk-7-jdk                   7u95-2.6.4-0ubuntu0.14.04.2
  openjdk-7-jre                   7u95-2.6.4-0ubuntu0.14.04.2
  openjdk-7-jre-headless          7u95-2.6.4-0ubuntu0.14.04.2
  openjdk-7-jre-lib               7u95-2.6.4-0ubuntu0.14.04.2
  openjdk-7-jre-zero              7u95-2.6.4-0ubuntu0.14.04.2

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-2942-1

  CVE-2016-0636

Severity
critical
Lowest
Low
Medium
High
Critical

March 24, 2016

Topics%20covered

Topics Covered

security advisory denial of service security issue Ubuntu information disclosure Linux advisory OpenJDK

Package Information

  https://launchpad.net/ubuntu/+source/openjdk-7/7u95-2.6.4-0ubuntu0.15.10.2
  https://launchpad.net/ubuntu/+source/openjdk-7/7u95-2.6.4-0ubuntu0.14.04.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.