This update for java-1_8_0-ibm fixes the following issues: Updated to Java 8.0 Service Refresh 8 Fix Pack 6 (bsc#1213000):. # Security update for java-1_8_0-ibm Announcement ID: SUSE-SU-2023:2862-1 Rating: important References: * #1213000 Affected Products: * Legacy Module 15-SP4 * Legacy Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that has one fix can now be installed. ## Description: This update for java-1_8_0-ibm fixes the following issues: Updated to Java 8.0 Service Refresh 8 Fix Pack 6 (bsc#1213000): * Fixed issue in Java Virtual Machine where outofmemory (OOM) killer terminates the jvm due to failure in control groups detection. ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE LinuxEnterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2862=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-2862=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-2862=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2862=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-2862=1 * SUSE Enterprise Storage 7 zypper in -t patch SUSE-Storage-7-2023-2862=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2862=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-2862=1 * Legacy Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-2862=1 * Legacy Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP5-2023-2862=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2862=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2862=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-2862=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-2862=1 ## Package List: * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSELinux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * SUSE Enterprise Storage 7.1 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Enterprise Storage 7.1 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Enterprise Storage 7 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Enterprise Storage 7 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 *java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE CaaS Platform 4.0 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE CaaS Platform 4.0 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * openSUSE Leap 15.4 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * openSUSE Leap 15.4 (x86_64) * java-1_8_0-ibm-32bit-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-32bit-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * java-1_8_0-ibm-demo-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-src-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * openSUSE Leap 15.5 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * openSUSE Leap 15.5 (x86_64) * java-1_8_0-ibm-32bit-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-32bit-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * java-1_8_0-ibm-demo-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-src-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * Legacy Module 15-SP4 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * Legacy Module 15-SP4 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * Legacy Module 15-SP4 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * Legacy Module 15-SP5 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * Legacy Module 15-SP5 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * Legacy Module 15-SP5 (x86_64) *java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.6-150000.3.77.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (x86_64) * java-1_8_0-ibm-alsa-1.8.0_sr8.6-150000.3.77.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.6-150000.3.77.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1213000 . Crucial patch released for java-1_8_0-ibm targeting significant vulnerabilities in openSUSE versions.. Java Update, SUSE, Security Advisory, OpenSUSE Patch, Service Refresh. . Severity: Important. LinuxSecurity.com Team
An update that fixes 8 vulnerabilities is now available. . SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:14398-1 Rating: important References: #1169511 #1172277 Cross-References: CVE-2020-2654 CVE-2020-2756 CVE-2020-2757 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830 Affected Products: SUSE Linux Enterprise Server 11-SP4-LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for java-1_7_1-ibm fixes the following issues: java-1_7_1-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 (bsc#1172277 and bsc#1169511) - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2756: Improved mapping of serial ENUMs - CVE-2020-2757: Less Blocking Array Queues - CVE-2020-2781: Improved TLS session handling - CVE-2020-2800: Improved Headings for HTTP Servers - CVE-2020-2803: Enhanced buffering of byte buffers - CVE-2020-2805: Enhanced typing of methods - CVE-2020-2830: Improved Scanner conversions Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-java-1_7_1-ibm-14398=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.65-26.55.1 java-1_7_1-ibm-devel-1.7.1_sr4.65-26.55.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.65-26.55.1 - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.65-26.55.1 java-1_7_1-ibm-plugin-1.7.1_sr4.65-26.55.1 References: https://www.suse.com/security/cve/CVE-2020-2654.html https://www.suse.com/security/cve/CVE-2020-2756.html https://www.suse.com/security/cve/CVE-2020-2757.html https://www.suse.com/security/cve/CVE-2020-2781.html https://www.suse.com/security/cve/CVE-2020-2800.html https://www.suse.com/security/cve/CVE-2020-2803.html https://www.suse.com/security/cve/CVE-2020-2805.html https://www.suse.com/security/cve/CVE-2020-2830.html https://bugzilla.suse.com/1169511 https://bugzilla.suse.com/1172277 _______________________________________________ sle-security-updates mailing list
IBM Java 6 was updated to Service Refresh 7. IBM Java 6 was updated to Service Refresh 7. The following security issues were fixed: CVE-2009-3876 CVE-2009-3877: A vulnerability in the Java Runtime Environment with decoding DER encoded data might allow a remote client to cause the JRE to crash, resulting in a denial of service condition.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: java-1_6_0-ibm Announcement ID: SUSE-SA:2010:004 Date: Tue, 12 Jan 2010 17:00:00 +0000 Affected Products: SLE 11 SLES 11 Vulnerability Type: remote code execution CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) SUSE Default Package: yes Cross-References: CVE-2009-0217, CVE-2009-3865, CVE-2009-3866 CVE-2009-3867, CVE-2009-3868, CVE-2009-3869 CVE-2009-3871, CVE-2009-3872, CVE-2009-3873 CVE-2009-3874, CVE-2009-3875, CVE-2009-3876 CVE-2009-3877 Content of This Advisory: 1) Security Vulnerability Resolved: IBM Java 6 security update Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion IBM Java 6 was updated to Service Refresh 7. The following security issues were fixed: CVE-2009-3876 CVE-2009-3877: A vulnerability in the Java Runtime Environment with decoding DER encoded datamight allow a remote client to cause the JRE to crash, resulting in a denial of service condition. CVE-2009-3867: A buffer overflow vulnerability in the Java Runtime Environment audio system might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. CVE-2009-3868: A buffer overflow vulnerability in the Java Runtime Environment with parsing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. CVE-2009-3872: An integer overflow vulnerability in the Java Runtime Environment with reading JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. CVE-2009-3873: A buffer overflow vulnerability in the Java Runtime Environment with processing JPEG files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files, or run local applications that are accessible to the user running the untrusted applet. CVE-2009-3875: A security vulnerability in the Java Runtime Environment with verifying HMAC digests might allow authentication to be bypassed. This action can allow a user to forge a digital signature that would be accepted as valid. Applications that validate HMAC-based digital signatures might be vulnerable to this type of attack. CVE-2009-3865: A commandexecution vulnerability in the Java Runtime Environment Deployment Toolkit might be used to run arbitrary code. This issue might occur as the result of a user of the Java Runtime Environment viewing a specially crafted web page that exploits this vulnerability. CVE-2009-3869: A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. CVE-2009-3871: A buffer overflow vulnerability in the Java Runtime Environment with processing image files might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. CVE-2009-3866: A security vulnerability in the Java Web Start Installer might be used to allow an untrusted Java Web Start application to run as a trusted application and run arbitrary code. This issue might occur as the result of a user of the Java Runtime Environment viewing a specially crafted web page that exploits this vulnerability. CVE-2009-3874: An integer overflow vulnerability in the Java Runtime Environment with processing JPEG images might allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet might grant itself permissions to read and write local files or run local applications that are accessible to the user running the untrusted applet. CVE-2009-0217: A vulnerability with verifying HMAC-based XML digital signatures in the XML Digital Signature implementation included with the Java Runtime Environment (JRE) might allow authentication to be bypassed.Applications that validate HMAC-based XML digital signatures might be vulnerable to this type of attack. Note: This vulnerability cannot be exploited by an untrusted applet or Java Web Start application. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of IBM Java 6 applications after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SLES 11 SLE 11 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The outputfor a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Get the latest Linux and open source security news straight to your inbox.