137 lines
7.2 KiB
XML
137 lines
7.2 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||
<glsa id="201603-14">
|
||
<title>IcedTea: Multiple vulnerabilities</title>
|
||
<synopsis>Multiple vulnerabilities have been found in IcedTea allowing remote
|
||
attackers to affect confidentiality, integrity, and availability through
|
||
various vectors.
|
||
</synopsis>
|
||
<product type="ebuild"></product>
|
||
<announced>March 12, 2016</announced>
|
||
<revised>April 19, 2016: 2</revised>
|
||
<bug>537940</bug>
|
||
<bug>559532</bug>
|
||
<bug>565842</bug>
|
||
<bug>567850</bug>
|
||
<bug>572716</bug>
|
||
<access>remote</access>
|
||
<affected>
|
||
<package name="dev-java/icedtea" auto="yes" arch="*">
|
||
<unaffected range="ge">7.2.6.4</unaffected>
|
||
<unaffected range="rge">6.1.13.9</unaffected>
|
||
<unaffected range="lt">6</unaffected>
|
||
<vulnerable range="lt">7.2.6.4</vulnerable>
|
||
</package>
|
||
<package name="dev-java/icedtea-bin" auto="yes" arch="*">
|
||
<unaffected range="ge">7.2.6.4</unaffected>
|
||
<unaffected range="rge">6.1.13.9</unaffected>
|
||
<unaffected range="lt">6</unaffected>
|
||
<vulnerable range="lt">7.2.6.4</vulnerable>
|
||
</package>
|
||
</affected>
|
||
<background>
|
||
<p>IcedTea’s aim is to provide OpenJDK in a form suitable for easy
|
||
configuration, compilation and distribution with the primary goal of
|
||
allowing inclusion in GNU/Linux distributions.
|
||
</p>
|
||
</background>
|
||
<description>
|
||
<p>Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot,
|
||
Libraries, and JAXP, exist which allows remote attackers to affect the
|
||
confidentiality, integrity, and availability of vulnerable systems. This
|
||
includes the possibility of remote execution of arbitrary code,
|
||
information disclosure, or Denial of Service. Many of the
|
||
vulnerabilities can only be exploited through sandboxed Java Web Start
|
||
applications and java applets. Please reference the CVEs listed for
|
||
specific details.
|
||
</p>
|
||
</description>
|
||
<impact type="normal">
|
||
<p>Remote attackers may remotely execute arbitrary code, compromise
|
||
information, or cause Denial of Service.
|
||
</p>
|
||
</impact>
|
||
<workaround>
|
||
<p>There is no known work around at this time.</p>
|
||
</workaround>
|
||
<resolution>
|
||
<p>IcedTea 7.x users should upgrade to the latest version:</p>
|
||
|
||
<code>
|
||
# emerge --sync
|
||
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-7.2.6.4"
|
||
</code>
|
||
|
||
<p>IcedTea bin 7.x users should upgrade to the latest version:</p>
|
||
|
||
<code>
|
||
# emerge --sync
|
||
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-7.2.6.4"
|
||
</code>
|
||
|
||
<p>IcedTea 6.x users should upgrade to the latest version:</p>
|
||
|
||
<code>
|
||
# emerge --sync
|
||
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-6.1.13.9"
|
||
</code>
|
||
|
||
<p>IcedTea bin 6.x users should upgrade to the latest version:</p>
|
||
|
||
<code>
|
||
# emerge --sync
|
||
# emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-6.1.13.9"
|
||
</code>
|
||
</resolution>
|
||
<references>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6585">CVE-2014-6585</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6587">CVE-2014-6587</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6591">CVE-2014-6591</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6593">CVE-2014-6593</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6601">CVE-2014-6601</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0383">CVE-2015-0383</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0395">CVE-2015-0395</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0400">CVE-2015-0400</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0407">CVE-2015-0407</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0408">CVE-2015-0408</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0412">CVE-2015-0412</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2590">CVE-2015-2590</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2601">CVE-2015-2601</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2613">CVE-2015-2613</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2621">CVE-2015-2621</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2625">CVE-2015-2625</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2628">CVE-2015-2628</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2632">CVE-2015-2632</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4731">CVE-2015-4731</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4732">CVE-2015-4732</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4733">CVE-2015-4733</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4734">CVE-2015-4734</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4748">CVE-2015-4748</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4749">CVE-2015-4749</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4760">CVE-2015-4760</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4803">CVE-2015-4803</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4805">CVE-2015-4805</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4806">CVE-2015-4806</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4835">CVE-2015-4835</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4840">CVE-2015-4840</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4842">CVE-2015-4842</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4843">CVE-2015-4843</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4844">CVE-2015-4844</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4860">CVE-2015-4860</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4871">CVE-2015-4871</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4872">CVE-2015-4872</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4881">CVE-2015-4881</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4882">CVE-2015-4882</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4883">CVE-2015-4883</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4893">CVE-2015-4893</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4903">CVE-2015-4903</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4911">CVE-2015-4911</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0402">CVE-2016-0402</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0448">CVE-2016-0448</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0466">CVE-2016-0466</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0483">CVE-2016-0483</uri>
|
||
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0494">CVE-2016-0494</uri>
|
||
</references>
|
||
<metadata tag="requester" timestamp="Thu, 16 Jul 2015 14:44:12 +0000">K_F</metadata>
|
||
<metadata tag="submitter" timestamp="Tue, 19 Apr 2016 21:34:37 +0000">b-man</metadata>
|
||
</glsa>
|