diff options
Diffstat (limited to 'metadata/glsa/glsa-201603-14.xml')
| -rw-r--r-- | metadata/glsa/glsa-201603-14.xml | 135 |
1 files changed, 135 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-201603-14.xml b/metadata/glsa/glsa-201603-14.xml new file mode 100644 index 000000000000..94c1808dfbec --- /dev/null +++ b/metadata/glsa/glsa-201603-14.xml @@ -0,0 +1,135 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="201603-14"> + <title>IcedTea: Multiple vulnerabilities</title> + <synopsis>Multiple vulnerabilities have been found in IcedTea allowing remote + attackers to affect confidentiality, integrity, and availability through + various vectors. + </synopsis> + <product type="ebuild"></product> + <announced>March 12, 2016</announced> + <revised>March 12, 2016: 1</revised> + <bug>537940</bug> + <bug>559532</bug> + <bug>565842</bug> + <bug>567850</bug> + <bug>572716</bug> + <access>remote</access> + <affected> + <package name="dev-java/icedtea" auto="yes" arch="*"> + <unaffected range="ge">7.2.6.4</unaffected> + <unaffected range="rge">6.1.13.9</unaffected> + <vulnerable range="lt">7.2.6.4</vulnerable> + </package> + <package name="dev-java/icedtea-bin" auto="yes" arch="*"> + <unaffected range="ge">7.2.6.4</unaffected> + <unaffected range="rge">6.1.13.9</unaffected> + <vulnerable range="lt">7.2.6.4</vulnerable> + </package> + </affected> + <background> + <p>IcedTea’s aim is to provide OpenJDK in a form suitable for easy + configuration, compilation and distribution with the primary goal of + allowing inclusion in GNU/Linux distributions. + </p> + </background> + <description> + <p>Various OpenJDK attack vectors in IcedTea, such as 2D, Corba, Hotspot, + Libraries, and JAXP, exist which allows remote attackers to affect the + confidentiality, integrity, and availability of vulnerable systems. This + includes the possibility of remote execution of arbitrary code, + information disclosure, or Denial of Service. Many of the + vulnerabilities can only be exploited through sandboxed Java Web Start + applications and java applets. Please reference the CVEs listed for + specific details. + </p> + </description> + <impact type="normal"> + <p>Remote attackers may remotely execute arbitrary code, compromise + information, or cause Denial of Service. + </p> + </impact> + <workaround> + <p>There is no known work around at this time.</p> + </workaround> + <resolution> + <p>IcedTea 7.x users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-7.2.6.4" + </code> + + <p>IcedTea bin 7.x users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-7.2.6.4" + </code> + + <p>IcedTea 6.x users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-6.1.13.9" + </code> + + <p>IcedTea bin 6.x users should upgrade to the latest version:</p> + + <code> + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/icedtea-bin-6.1.13.9" + </code> + </resolution> + <references> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6585">CVE-2014-6585</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6587">CVE-2014-6587</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6591">CVE-2014-6591</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6593">CVE-2014-6593</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6601">CVE-2014-6601</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0383">CVE-2015-0383</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0395">CVE-2015-0395</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0400">CVE-2015-0400</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0407">CVE-2015-0407</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0408">CVE-2015-0408</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0412">CVE-2015-0412</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2590">CVE-2015-2590</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2601">CVE-2015-2601</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2613">CVE-2015-2613</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2621">CVE-2015-2621</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2625">CVE-2015-2625</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2628">CVE-2015-2628</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2632">CVE-2015-2632</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4731">CVE-2015-4731</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4732">CVE-2015-4732</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4733">CVE-2015-4733</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4734">CVE-2015-4734</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4748">CVE-2015-4748</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4749">CVE-2015-4749</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4760">CVE-2015-4760</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4803">CVE-2015-4803</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4805">CVE-2015-4805</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4806">CVE-2015-4806</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4835">CVE-2015-4835</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4840">CVE-2015-4840</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4842">CVE-2015-4842</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4843">CVE-2015-4843</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4844">CVE-2015-4844</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4860">CVE-2015-4860</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4871">CVE-2015-4871</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4872">CVE-2015-4872</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4881">CVE-2015-4881</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4882">CVE-2015-4882</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4883">CVE-2015-4883</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4893">CVE-2015-4893</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4903">CVE-2015-4903</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4911">CVE-2015-4911</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0402">CVE-2016-0402</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0448">CVE-2016-0448</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0466">CVE-2016-0466</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0483">CVE-2016-0483</uri> + <uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0494">CVE-2016-0494</uri> + </references> + <metadata tag="requester" timestamp="Thu, 16 Jul 2015 14:44:12 +0000">K_F</metadata> + <metadata tag="submitter" timestamp="Sat, 12 Mar 2016 23:37:32 +0000">b-man</metadata> +</glsa> |