Security update for java-1_7_0-openjdk
This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed: - CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084). - CVE-2017-10274: Fix issue inside subcomponent Smart Card IO (bsc#1064071). - CVE-2017-10281: Fix issue inside subcomponent Serialization (bsc#1064072). - CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073). - CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075). - CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086). - CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078). - CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082). - CVE-2017-10347: Fix issue inside subcomponent Serialization (bsc#1064079). - CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081). - CVE-2017-10345: Fix issue inside subcomponent Serialization (bsc#1064077). - CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080). - CVE-2017-10357: Fix issue inside subcomponent Serialization (bsc#1064085). - CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083). - CVE-2017-10102: Fix incorrect handling of references in DGC (bsc#1049316). - CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader (bsc#1049305). - CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest (bsc#1049306). - CVE-2017-10081: Fix incorrect bracket processing in function signature handling (bsc#1049309). - CVE-2017-10087: Fix insufficient access control checks in ThreadPoolExecutor (bsc#1049311). - CVE-2017-10089: Fix insufficient access control checks in ServiceRegistry (bsc#1049312). - CVE-2017-10090: Fix insufficient access control checks in AsynchronousChannelGroupImpl (bsc#1049313). - CVE-2017-10096: Fix insufficient access control checks in XML transformations (bsc#1049314). - CVE-2017-10101: Fix unrestricted access to com.sun.org.apache.xml.internal.resolver (bsc#1049315). - CVE-2017-10107: Fix insufficient access control checks in ActivationID (bsc#1049318). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10110: Fix insufficient access control checks in ImageWatched (bsc#1049321). - CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute deserialization (bsc#1049319). - CVE-2017-10109: Fix unbounded memory allocation in CodeSource deserialization (bsc#1049320). - CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE (bsc#1049324). - CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326). - CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL (bsc#1049325). - CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328). - CVE-2017-10176: Fix incorrect handling of certain EC points (bsc#1049329). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322). - CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS (bsc#1049332). - CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment (bsc#1049327). - CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX (bsc#1049323). - CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment (bsc#1049317). - CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310). - CVE-2017-10198: Fix incorrect enforcement of certificate path restrictions (bsc#1049331). - CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330). Bug fixes: - Drop Exec Shield workaround to fix crashes on recent kernels, where Exec Shield is gone (bsc#1052318).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed: - CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084). - CVE-2017-10274: Fix issue inside subcomponent Smart Card IO (bsc#1064071). - CVE-2017-10281: Fix issue inside subcomponent Serialization (bsc#1064072). - CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073). - CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075). - CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086). - CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078). - CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082). - CVE-2017-10347: Fix issue inside subcomponent Serialization (bsc#1064079). - CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081). - CVE-2017-10345: Fix issue inside subcomponent Serialization (bsc#1064077). - CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080). - CVE-2017-10357: Fix issue inside subcomponent Serialization (bsc#1064085). - CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083). - CVE-2017-10102: Fix incorrect handling of references in DGC (bsc#1049316). - CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader (bsc#1049305). - CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest (bsc#1049306). - CVE-2017-10081: Fix incorrect bracket processing in function signature handling (bsc#1049309). - CVE-2017-10087: Fix insufficient access control checks in ThreadPoolExecutor (bsc#1049311). - CVE-2017-10089: Fix insufficient access control checks in ServiceRegistry (bsc#1049312). - CVE-2017-10090: Fix insufficient access control checks in AsynchronousChannelGroupImpl (bsc#1049313). - CVE-2017-10096: Fix insufficient access control checks in XML transformations (bsc#1049314). - CVE-2017-10101: Fix unrestricted access to com.sun.org.apache.xml.internal.resolver (bsc#1049315). - CVE-2017-10107: Fix insufficient access control checks in ActivationID (bsc#1049318). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10110: Fix insufficient access control checks in ImageWatched (bsc#1049321). - CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute deserialization (bsc#1049319). - CVE-2017-10109: Fix unbounded memory allocation in CodeSource deserialization (bsc#1049320). - CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE (bsc#1049324). - CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326). - CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL (bsc#1049325). - CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328). - CVE-2017-10176: Fix incorrect handling of certain EC points (bsc#1049329). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322). - CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS (bsc#1049332). - CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment (bsc#1049327). - CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX (bsc#1049323). - CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment (bsc#1049317). - CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310). - CVE-2017-10198: Fix incorrect enforcement of certificate path restrictions (bsc#1049331). - CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330). Bug fixes: - Drop Exec Shield workaround to fix crashes on recent kernels, where Exec Shield is gone (bsc#1052318).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1049305
- https://bugzilla.suse.com/1049306
- https://bugzilla.suse.com/1049307
- https://bugzilla.suse.com/1049309
- https://bugzilla.suse.com/1049310
- https://bugzilla.suse.com/1049311
- https://bugzilla.suse.com/1049312
- https://bugzilla.suse.com/1049313
- https://bugzilla.suse.com/1049314
- https://bugzilla.suse.com/1049315
- https://bugzilla.suse.com/1049316
- https://bugzilla.suse.com/1049317
- https://bugzilla.suse.com/1049318
- https://bugzilla.suse.com/1049319
- https://bugzilla.suse.com/1049320
- https://bugzilla.suse.com/1049321
- https://bugzilla.suse.com/1049322
- https://bugzilla.suse.com/1049323
- https://bugzilla.suse.com/1049324
- https://bugzilla.suse.com/1049325
- https://bugzilla.suse.com/1049326
- https://bugzilla.suse.com/1049327
- https://bugzilla.suse.com/1049328
- https://bugzilla.suse.com/1049329
- https://bugzilla.suse.com/1049330
- https://bugzilla.suse.com/1049331
- https://bugzilla.suse.com/1049332
- https://bugzilla.suse.com/1052318
- https://bugzilla.suse.com/1064071
- https://bugzilla.suse.com/1064072
- https://bugzilla.suse.com/1064073
- https://bugzilla.suse.com/1064075
- https://bugzilla.suse.com/1064077
- https://bugzilla.suse.com/1064078
- https://bugzilla.suse.com/1064079
- https://bugzilla.suse.com/1064080
- https://bugzilla.suse.com/1064081
- https://bugzilla.suse.com/1064082
- https://bugzilla.suse.com/1064083
- https://bugzilla.suse.com/1064084
- https://bugzilla.suse.com/1064085
- https://bugzilla.suse.com/1064086
- https://www.suse.com/security/cve/CVE-2016-10165
- https://www.suse.com/security/cve/CVE-2016-9840
- https://www.suse.com/security/cve/CVE-2016-9841
- https://www.suse.com/security/cve/CVE-2016-9842
- https://www.suse.com/security/cve/CVE-2016-9843
- https://www.suse.com/security/cve/CVE-2017-10053
- https://www.suse.com/security/cve/CVE-2017-10067
- https://www.suse.com/security/cve/CVE-2017-10074
- https://www.suse.com/security/cve/CVE-2017-10081
- https://www.suse.com/security/cve/CVE-2017-10086
- https://www.suse.com/security/cve/CVE-2017-10087
- https://www.suse.com/security/cve/CVE-2017-10089
- https://www.suse.com/security/cve/CVE-2017-10090
- https://www.suse.com/security/cve/CVE-2017-10096
- https://www.suse.com/security/cve/CVE-2017-10101
- https://www.suse.com/security/cve/CVE-2017-10102
- https://www.suse.com/security/cve/CVE-2017-10105
- https://www.suse.com/security/cve/CVE-2017-10107
- https://www.suse.com/security/cve/CVE-2017-10108
- https://www.suse.com/security/cve/CVE-2017-10109
- https://www.suse.com/security/cve/CVE-2017-10110
- https://www.suse.com/security/cve/CVE-2017-10111
- https://www.suse.com/security/cve/CVE-2017-10114
- https://www.suse.com/security/cve/CVE-2017-10115
- https://www.suse.com/security/cve/CVE-2017-10116
- https://www.suse.com/security/cve/CVE-2017-10118
- https://www.suse.com/security/cve/CVE-2017-10125
- https://www.suse.com/security/cve/CVE-2017-10135
- https://www.suse.com/security/cve/CVE-2017-10176
- https://www.suse.com/security/cve/CVE-2017-10193
- https://www.suse.com/security/cve/CVE-2017-10198
- https://www.suse.com/security/cve/CVE-2017-10243
- https://www.suse.com/security/cve/CVE-2017-10274
- https://www.suse.com/security/cve/CVE-2017-10281
- https://www.suse.com/security/cve/CVE-2017-10285
- https://www.suse.com/security/cve/CVE-2017-10295
- https://www.suse.com/security/cve/CVE-2017-10345
- https://www.suse.com/security/cve/CVE-2017-10346
- https://www.suse.com/security/cve/CVE-2017-10347
- https://www.suse.com/security/cve/CVE-2017-10348
- https://www.suse.com/security/cve/CVE-2017-10349
- https://www.suse.com/security/cve/CVE-2017-10350
- https://www.suse.com/security/cve/CVE-2017-10355
- https://www.suse.com/security/cve/CVE-2017-10356
- https://www.suse.com/security/cve/CVE-2017-10357
- https://www.suse.com/security/cve/CVE-2017-10388
- https://www.suse.com/support/update/announcement/2018/suse-su-20180005-1/