Advisories ยป MGASA-2015-0412

Updated java-1.8.0-openjdk packages fix security vulnerabilities

Publication date: 25 Oct 2015
Modification date: 25 Oct 2015
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-4803 , CVE-2015-4805 , CVE-2015-4806 , CVE-2015-4734 , CVE-2015-4835 , CVE-2015-4840 , CVE-2015-4842 , CVE-2015-4843 , CVE-2015-4844 , CVE-2015-4860 , CVE-2015-4868 , CVE-2015-4872 , CVE-2015-4881 , CVE-2015-4882 , CVE-2015-4883 , CVE-2015-4893 , CVE-2015-4903 , CVE-2015-4911

Description

Updated java-1.8.0-openjdk packages fix security vulnerabilities:

Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization,
and 2D components in OpenJDK. An untrusted Java application or applet could
use these flaws to completely bypass Java sandbox restrictions
(CVE-2015-4835, CVE-2015-4881, CVE-2015-4843, CVE-2015-4883, CVE-2015-4860,
CVE-2015-4805, CVE-2015-4844).

Multiple denial of service flaws were found in the JAXP component in
OpenJDK. A specially crafted XML file could cause a Java application using
JAXP to consume an excessive amount of CPU and memory when parsed
(CVE-2015-4803, CVE-2015-4893, CVE-2015-4911).

A flaw was found in the way the Libraries component in OpenJDK handled
certificate revocation lists (CRL). In certain cases, CRL checking code
could fail to report a revoked certificate, causing the application to
accept it as trusted (CVE-2015-4868).

It was discovered that the Security component in OpenJDK failed to properly
check if a certificate satisfied all defined constraints. In certain cases,
this could cause a Java application to accept an X.509 certificate which
does not meet requirements of the defined policy (CVE-2015-4872).

Multiple flaws were found in the Libraries, 2D, CORBA, JAXP, JGSS, and RMI
components in OpenJDK. An untrusted Java application or applet could use
these flaws to bypass certain Java sandbox restrictions (CVE-2015-4806,
CVE-2015-4840, CVE-2015-4882, CVE-2015-4842, CVE-2015-4734, CVE-2015-4903).

References

SRPMS

5/core